usebeeline 0.0.37 → 0.0.40

package/dist/usebeeline.mjs

@@ -307,14 +307,14 @@ __export(self_update_exports, {
   writeUpdateAttemptFixture: () => writeUpdateAttemptFixture,
   writeUpdateState: () => writeUpdateState
 });
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
-import { access, chmod as chmod3, lstat as lstat2, mkdir as mkdir9, open, readFile as readFile4, rename as rename3, rm as rm4, symlink as symlink2, writeFile as writeFile6 } from "node:fs/promises";
+import { access, chmod as chmod3, lstat as lstat2, mkdir as mkdir10, open, readFile as readFile8, rename as rename3, rm as rm4, symlink as symlink2, writeFile as writeFile8 } from "node:fs/promises";
 import { spawn as spawn4 } from "node:child_process";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname8, join as join6, resolve as resolve14 } from "node:path";
+import { dirname as dirname9, join as join6, resolve as resolve18 } from "node:path";
 function anchorLayout(rawLibDir) {
-  const libDir = resolve14(rawLibDir);
+  const libDir = resolve18(rawLibDir);
   const segments = libDir.split(/[/\\]/);
   const idx = segments.lastIndexOf(RELEASES_SEGMENT);
   if (idx >= 2 && segments[idx - 1] === "lib") {
@@ -330,9 +330,9 @@ function anchorLayout(rawLibDir) {
     // prefix's bin, NOT <prefix>/lib/bin — deriving it one level up was the
     // defect that made activateRelease write its stable forwarders where
     // nothing executed them, leaving stale raw wrappers in <prefix>/bin.
-    binDir: resolve14(libDir, "../../bin"),
+    binDir: resolve18(libDir, "../../bin"),
     libDir,
-    releasesRoot: resolve14(libDir, `../${RELEASES_SEGMENT}`)
+    releasesRoot: resolve18(libDir, `../${RELEASES_SEGMENT}`)
   };
 }
 function beelineInstallLayout(env = process.env) {
@@ -343,7 +343,7 @@ function beelineInstallLayout(env = process.env) {
 }
 function defaultBeelineInstallLayout(env = process.env) {
   const home = env.HOME?.trim() || homedir9();
-  return anchorLayout(resolve14(home, ".local", "lib", "beeline"));
+  return anchorLayout(resolve18(home, ".local", "lib", "beeline"));
 }
 function hostPlatformKey() {
   const os = process.platform === "linux" ? "linux" : process.platform === "darwin" ? "darwin" : "";
@@ -359,7 +359,7 @@ async function readBundleJson(bundleDir) {
   let raw;
   for (const candidate of bundleJsonCandidates(bundleDir)) {
     try {
-      raw = await readFile4(candidate, "utf8");
+      raw = await readFile8(candidate, "utf8");
       break;
     } catch {
     }
@@ -381,14 +381,14 @@ function updateStatePath(layout) {
 }
 async function readUpdateState(layout) {
   try {
-    return JSON.parse(await readFile4(updateStatePath(layout), "utf8"));
+    return JSON.parse(await readFile8(updateStatePath(layout), "utf8"));
   } catch {
     return {};
   }
 }
 async function writeUpdateState(layout, state) {
-  await mkdir9(join6(layout.releasesRoot, ".state"), { recursive: true });
-  await writeFile6(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
+  await mkdir10(join6(layout.releasesRoot, ".state"), { recursive: true });
+  await writeFile8(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 async function readInstalledBundleIdentity(layout, _state = {}) {
@@ -495,13 +495,13 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
   const okMarker = join6(releaseDir, ".stage-ok");
   let previouslyVerified = false;
   try {
-    const recorded = await readFile4(okMarker, "utf8");
+    const recorded = await readFile8(okMarker, "utf8");
     if (recorded.trim() === published.sha256)
       return releaseId;
     previouslyVerified = true;
   } catch {
   }
-  await mkdir9(releaseDir, { recursive: true });
+  await mkdir10(releaseDir, { recursive: true });
   const tempArchive = join6(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
   try {
     log(`downloading ${published.file}`);
@@ -511,7 +511,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     if (!response.ok || !response.body) {
       throw new Error(`downloading ${published.file} failed: HTTP ${response.status}`);
     }
-    const hash = createHash2("sha256");
+    const hash = createHash3("sha256");
     const chunks = [];
     for await (const chunk of response.body) {
       const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
@@ -522,7 +522,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     if (actual !== published.sha256.toLowerCase()) {
       throw new Error(`checksum mismatch for ${published.file}: expected ${published.sha256}, got ${actual} \u2014 aborting without touching the installed bundle`);
     }
-    await writeFile6(tempArchive, Buffer.concat(chunks), { mode: 384 });
+    await writeFile8(tempArchive, Buffer.concat(chunks), { mode: 384 });
     const entries = (await new Promise((resolveList, rejectList) => {
       const child = spawn4("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
       let out = "";
@@ -553,7 +553,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
         throw new Error(`staged bundle failed its startup smoke test (--version exited ${probe.status})${probe.stderr ? `: ${probe.stderr.trim()}` : ""}`);
       }
     }
-    await writeFile6(okMarker, `${published.sha256}
+    await writeFile8(okMarker, `${published.sha256}
 `, "utf8");
     log(`staged release ${releaseId} (sha256 verified)`);
     return releaseId;
@@ -581,15 +581,15 @@ function forwarderScript(tool) {
 }
 async function replaceFile(path, contents, mode) {
   const temp = `${path}.new-${process.pid}`;
-  await writeFile6(temp, contents, { mode });
+  await writeFile8(temp, contents, { mode });
   await chmod3(temp, mode);
   await rename3(temp, path);
 }
 async function activateRelease(layout, releaseId) {
   const releaseDir = join6(layout.releasesRoot, releaseId);
   await access(join6(releaseDir, BUNDLE_ENTRYPOINT), fsConstants.F_OK);
-  await mkdir9(layout.releasesRoot, { recursive: true });
-  await mkdir9(layout.binDir, { recursive: true });
+  await mkdir10(layout.releasesRoot, { recursive: true });
+  await mkdir10(layout.binDir, { recursive: true });
   let previousReleaseId = await activeReleaseId(layout);
   const kind = await pathKind(layout.libDir);
   if (kind === "directory") {
@@ -611,7 +611,7 @@ async function activateRelease(layout, releaseId) {
   await rm4(tempLink, { force: true });
   await symlink2(join6("beeline-releases", releaseId), tempLink);
   await rename3(tempLink, layout.libDir);
-  await fsyncDir(dirname8(layout.libDir));
+  await fsyncDir(dirname9(layout.libDir));
   await writeBinForwarders(layout, releaseDir);
   return { previousReleaseId };
 }
@@ -628,7 +628,7 @@ async function normalizeLegacyBundleShape(bundleDir) {
   }
   if (!anyFlat)
     return;
-  await mkdir9(innerLib, { recursive: true });
+  await mkdir10(innerLib, { recursive: true });
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
       await access(join6(innerLib, name), fsConstants.F_OK);
@@ -655,13 +655,13 @@ async function repairInstallForwarders(layout, opts = {}) {
   const forwarderPath = join6(layout.binDir, "beeline");
   let current;
   try {
-    current = await readFile4(forwarderPath, "utf8");
+    current = await readFile8(forwarderPath, "utf8");
   } catch {
     current = void 0;
   }
   if (current === forwarderScript("beeline"))
     return false;
-  await mkdir9(layout.binDir, { recursive: true });
+  await mkdir10(layout.binDir, { recursive: true });
   await writeBinForwarders(layout, layout.libDir);
   opts.logger?.(`[body] self-update: repaired <prefix>/bin forwarders to follow the active-bundle anchor (${layout.libDir})`);
   return true;
@@ -676,14 +676,14 @@ async function rollbackToPreviousRelease(layout, previousReleaseId) {
   await rm4(tempLink, { force: true });
   await symlink2(join6("beeline-releases", previousReleaseId), tempLink);
   await rename3(tempLink, layout.libDir);
-  await fsyncDir(dirname8(layout.libDir));
+  await fsyncDir(dirname9(layout.libDir));
 }
 function updateAttemptPath(layout) {
   return join6(layout.releasesRoot, ".state", "update-attempt.json");
 }
 async function readUpdateAttempt(layout) {
   try {
-    const raw = JSON.parse(await readFile4(updateAttemptPath(layout), "utf8"));
+    const raw = JSON.parse(await readFile8(updateAttemptPath(layout), "utf8"));
     if (raw.version !== 1 || typeof raw.appliedAt !== "number" || typeof raw.confirmBy !== "number" || typeof raw.releaseId !== "string" || !["pending", "confirmed", "reverted"].includes(raw.status)) {
       return void 0;
     }
@@ -693,10 +693,10 @@ async function readUpdateAttempt(layout) {
   }
 }
 async function writeUpdateAttempt(layout, record2) {
-  await mkdir9(join6(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir10(join6(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile6(staged, `${JSON.stringify(record2, null, 2)}
+  await writeFile8(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename3(staged, path);
 }
@@ -955,8 +955,8 @@ var init_self_update = __esm({
 });
 
 // apps/body/dist/cli.js
-import { dirname as dirname13, resolve as resolve21 } from "node:path";
-import { readFile as readFile9, unlink as unlink3, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname14, resolve as resolve25 } from "node:path";
+import { readFile as readFile13, unlink as unlink3, writeFile as writeFile14 } from "node:fs/promises";
 import { stdin as stdin4, stdout as stdout5 } from "node:process";
 
 // node_modules/@clack/core/dist/index.mjs
@@ -3099,6 +3099,9 @@ function agentMessageChunkText(update) {
 }
 var CHUNK_CONTINUES_PREVIOUS_WORD = /^[\s'\u2018\u2019\u02bc.,!?;:%)\]}-]/;
 var PI_ACP_HARNESS = /(^|[/\\])pi-acp(?:\.[a-z]+)?$/i;
+function isPiAcpHarness(agentLabel) {
+  return Boolean(agentLabel && PI_ACP_HARNESS.test(agentLabel));
+}
 function withoutOneTrailingLineEnding(text2) {
   if (/\r?\n\r?\n$/.test(text2))
     return text2;
@@ -3166,6 +3169,19 @@ function finalAgentMessageText(updates, agentLabel) {
     return "";
   return last;
 }
+function describeEmptyTurn(result, agentLabel) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const { update } of result.updates) {
+    const kind = typeof update.sessionUpdate === "string" ? update.sessionUpdate : "unknown";
+    if (kind === "session_info_update" || kind === "available_commands_update")
+      continue;
+    counts.set(kind, (counts.get(kind) ?? 0) + 1);
+  }
+  const stream = counts.size ? `the stream carried only ${[...counts].map(([kind, count]) => `${kind}\xD7${count}`).join(", ")}` : "the stream carried no content updates";
+  const lastRun = agentMessageRuns(result.updates, agentLabel).at(-1);
+  const narration = lastRun && isPureRetryNarration(lastRun) ? `; the last message was retry narration "${lastRun.trim().slice(0, 80)}"` : "";
+  return `harness ended the turn (${result.stopReason}) with no answer text; ${stream}${narration}`;
+}
 function updateText(update) {
   const content = update.content;
   if (typeof content === "string")
@@ -3186,7 +3202,7 @@ var THOUGHT_UPDATE_TYPES = /* @__PURE__ */ new Set([
 ]);
 function agentStreamSnapshot(updates, agentLabel) {
   const completedMessages = [];
-  let messageText = "";
+  let messageText2 = "";
   let lastWasMessage = false;
   let thoughtText = "";
   let thoughtRunOpen = false;
@@ -3196,20 +3212,20 @@ function agentStreamSnapshot(updates, agentLabel) {
       const delta = normalizeStreamDelta(agentMessageChunkText(update), agentLabel);
       if (!delta)
         continue;
-      if (!lastWasMessage && messageText && !/\s$/.test(messageText) && !CHUNK_CONTINUES_PREVIOUS_WORD.test(delta)) {
-        if (!completedMessages.includes(messageText))
-          completedMessages.push(messageText);
-        messageText = "";
+      if (!lastWasMessage && messageText2 && !/\s$/.test(messageText2) && !CHUNK_CONTINUES_PREVIOUS_WORD.test(delta)) {
+        if (!completedMessages.includes(messageText2))
+          completedMessages.push(messageText2);
+        messageText2 = "";
       }
-      messageText += delta;
+      messageText2 += delta;
       lastWasMessage = true;
       thoughtRunOpen = false;
       continue;
     }
-    if (lastWasMessage && messageText) {
-      if (!completedMessages.includes(messageText))
-        completedMessages.push(messageText);
-      messageText = "";
+    if (lastWasMessage && messageText2) {
+      if (!completedMessages.includes(messageText2))
+        completedMessages.push(messageText2);
+      messageText2 = "";
     }
     lastWasMessage = false;
     if (THOUGHT_UPDATE_TYPES.has(kind)) {
@@ -3225,7 +3241,7 @@ function agentStreamSnapshot(updates, agentLabel) {
     }
   }
   return {
-    messageText,
+    messageText: messageText2,
     ...thoughtText || completedMessages.length ? { thoughtText: thoughtText || completedMessages.at(-1) } : {}
   };
 }
@@ -3720,7 +3736,7 @@ var AcpClient = class extends EventEmitter {
     const current = this.activeRunIds.get(sessionId);
     if (current)
       return Promise.resolve(current);
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve26, reject) => {
       const onUpdate = (update) => {
         if (update.sessionId !== sessionId)
           return;
@@ -3728,7 +3744,7 @@ var AcpClient = class extends EventEmitter {
         if (!runId)
           return;
         cleanup();
-        resolve22(runId);
+        resolve26(runId);
       };
       const timer = setTimeout(() => {
         cleanup();
@@ -3748,23 +3764,23 @@ var AcpClient = class extends EventEmitter {
     const tracked = metadataKey ? this.toolCallMetadata.get(metadataKey) : void 0;
     if (tracked)
       p.toolCall = { ...tracked, ...p.toolCall };
-    let decision = this.autoApprove ? "allow" : "reject";
+    let decision2 = this.autoApprove ? "allow" : "reject";
     if (!this.autoApprove && this.permissionAllowlist) {
       try {
-        decision = this.permissionAllowlist(p) ? "allow" : "reject";
+        decision2 = this.permissionAllowlist(p) ? "allow" : "reject";
       } catch (error) {
         this.emit("permission/error", error);
-        decision = "reject";
+        decision2 = "reject";
       }
     } else if (this.permissionHandler) {
       try {
-        decision = await this.permissionHandler(p);
+        decision2 = await this.permissionHandler(p);
       } catch (error) {
         this.emit("permission/error", error);
-        decision = "reject";
+        decision2 = "reject";
       }
     }
-    if (decision === "allow") {
+    if (decision2 === "allow") {
       const allow = p?.options?.find((o) => o.kind === "allow_once" || o.kind === "allow_always") ?? p?.options?.[0];
       if (allow?.optionId) {
         if (metadataKey)
@@ -3812,13 +3828,13 @@ var AcpClient = class extends EventEmitter {
     }
     const id = this.nextId++;
     const payload = { jsonrpc: "2.0", id, method, params };
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve26, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new AcpRequestTimeoutError(method, timeoutMs, this.stderrTail, Boolean(onStart)));
       }, timeoutMs);
       this.pending.set(id, {
-        resolve: resolve22,
+        resolve: resolve26,
         reject,
         timer,
         method,
@@ -4236,31 +4252,433 @@ async function applyRuntimeModelPreflight(config, agent, selection, validate = v
   config.modelUnavailable = await revalidateRuntimeModelSelection(agent, config.agentEnv, selection, validate);
 }
 
-// apps/body/dist/room-runtime.js
-import { execFile as execFile3 } from "node:child_process";
+// apps/body/dist/model-catalog-sync.js
 import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve as resolve5 } from "node:path";
+var MODEL_CATALOG_PROBE_TIMEOUT_MS = 3e4;
+var MODEL_CATALOG_HASH_FILE = "model-catalog.sha256";
+function modelCatalogHash(options, selection) {
+  return createHash("sha256").update(JSON.stringify({ options, selection: selection ?? null })).digest("hex");
+}
+async function withTimeout(work, timeoutMs, what) {
+  let timer;
+  const expiry = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${timeoutMs}ms`)), timeoutMs);
+  });
+  try {
+    return await Promise.race([work, expiry]);
+  } finally {
+    clearTimeout(timer);
+    work.catch(() => void 0);
+  }
+}
+async function syncAgentModelCatalog(input) {
+  const log = input.log ?? ((line) => console.log(line));
+  const fetchCatalog = input.fetchCatalog ?? fetchAgentModelCatalog;
+  const hashPath = resolve5(input.runtimeDir, MODEL_CATALOG_HASH_FILE);
+  try {
+    const configuration = await input.api.execute("getAgentConfiguration", {
+      agentId: input.agentId
+    });
+    const selection = configuration.model || configuration.effort ? {
+      ...configuration.model ? { model: configuration.model } : {},
+      ...configuration.effort ? { effort: configuration.effort } : {}
+    } : input.runtimeSelection;
+    const { catalog } = await withTimeout(fetchCatalog(input.agent, input.agentEnv, selection), input.timeoutMs ?? MODEL_CATALOG_PROBE_TIMEOUT_MS, "model catalog probe");
+    const hash = modelCatalogHash(catalog, selection);
+    const previous = await readFile(hashPath, "utf8").catch(() => "");
+    if (previous.trim() === hash)
+      return "unchanged";
+    await input.api.execute("postAgentModelCatalog", {
+      agentId: input.agentId,
+      workspaceId: input.workspaceId,
+      // `fetchAgentModelCatalog` already applied the category allow-list.
+      options: catalog,
+      ...selection ? { selection } : {}
+    });
+    await writeFile(hashPath, `${hash}
+`, { mode: 384 });
+    log(`[body] model catalog posted: ${catalog.length} axis(es)` + (selection?.model ? `, model ${selection.model}` : "") + (selection?.effort ? `, effort ${selection.effort}` : ""));
+    return "posted";
+  } catch (error) {
+    log(`[body] model catalog not posted this activation: ${error instanceof Error ? error.message : String(error)}`);
+    return "failed";
+  }
+}
+
+// apps/body/dist/room-runtime.js
+import { execFile as execFile4 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync } from "node:fs";
-import { mkdir as mkdir6, rm as rm3 } from "node:fs/promises";
-import { dirname as dirname4, resolve as resolve10 } from "node:path";
+import { mkdir as mkdir8, rm as rm3 } from "node:fs/promises";
+import { dirname as dirname6, resolve as resolve15 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
+// apps/body/dist/grant-runner.js
+import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { readFile as readFile3 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { dirname as dirname3, resolve as resolve7 } from "node:path";
+
+// packages/api-contract/dist/agent-grants.js
+var AGENT_GRANT_KINDS = ["path", "host", "secret", "device", "budget", "command"];
+var SHELL_METACHARACTERS = /[;&|<>$`\\'"(){}\n\r\t*?[\]~#!]/;
+var SECRET_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+function parseCommandGrantTarget(target) {
+  if (typeof target !== "string" || !target.trim()) {
+    throw new Error("command target is required");
+  }
+  if (target !== target.trim() || /\s{2,}/.test(target)) {
+    throw new Error("command target must be one line with single spaces");
+  }
+  if (SHELL_METACHARACTERS.test(target)) {
+    throw new Error("command target must not contain shell metacharacters");
+  }
+  const words = target.split(" ");
+  const argv = [];
+  const secrets = [];
+  for (let index = 0; index < words.length; index += 1) {
+    const word = words[index];
+    if (word === "--with") {
+      const name = words[index + 1];
+      if (!name || !SECRET_NAME.test(name)) {
+        throw new Error("--with must name one UPPER_CASE secret");
+      }
+      if (!secrets.includes(name))
+        secrets.push(name);
+      index += 1;
+      continue;
+    }
+    if (secrets.length)
+      throw new Error("--with suffixes must come after the command words");
+    argv.push(word);
+  }
+  if (!argv.length)
+    throw new Error("command target must name a command");
+  return { argv, secrets };
+}
+function commandGrantMatches(rule, requested) {
+  if (requested.length < rule.argv.length)
+    return false;
+  return rule.argv.every((word, index) => requested[index] === word);
+}
+var DECISION_LINE = new RegExp(`^(.+?) (approved once|approved|declined) (${AGENT_GRANT_KINDS.join("|")}) (.+)$`, "s");
+function parseGrantDecisionLine(body) {
+  const match = DECISION_LINE.exec(body);
+  if (!match)
+    return void 0;
+  const decision2 = match[2] === "approved once" ? "once" : match[2] === "approved" ? "always" : "deny";
+  return {
+    deciderName: match[1],
+    decision: decision2,
+    kind: match[3],
+    target: match[4]
+  };
+}
+
+// apps/body/dist/provider-key-store.js
+import { chmod, mkdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, resolve as resolve6 } from "node:path";
+var PROVIDER_KEY_ENV_VARS = {
+  openrouter: "OPENROUTER_API_KEY",
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY",
+  google: "GOOGLE_API_KEY",
+  xai: "XAI_API_KEY"
+};
+var GOOGLE_ENV_ALIAS = "GEMINI_API_KEY";
+function providerKeyStorePath(env = process.env) {
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve6(homedir2(), ".config");
+  return resolve6(configRoot, "beeline", "providers.json");
+}
+async function readProviderKeyStore(env = process.env) {
+  const path = providerKeyStorePath(env);
+  const raw = await readFile2(path, "utf8").catch(() => void 0);
+  if (!raw)
+    return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    const entries = Object.entries(parsed).filter((entry) => entry[0] in PROVIDER_KEY_ENV_VARS && typeof entry[1] === "string" && entry[1].length > 0);
+    return Object.fromEntries(entries);
+  } catch {
+    return {};
+  }
+}
+async function readSavedProviderKey(provider, env = process.env) {
+  return (await readProviderKeyStore(env))[provider];
+}
+async function saveProviderKey(provider, key, env = process.env) {
+  const path = providerKeyStorePath(env);
+  const store = { ...await readProviderKeyStore(env), [provider]: key };
+  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, `${JSON.stringify(store, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
+function providerKeyFromEnvironment(provider, env = process.env) {
+  const primary = env[PROVIDER_KEY_ENV_VARS[provider]]?.trim();
+  if (primary)
+    return primary;
+  if (provider === "google")
+    return env[GOOGLE_ENV_ALIAS]?.trim() || void 0;
+  return void 0;
+}
+function maskProviderKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length <= 9)
+    return "\u2026";
+  return `${trimmed.slice(0, 6)}\u2026${trimmed.slice(-3)}`;
+}
+
+// apps/body/dist/grant-runner.js
+var GRANT_COMMAND_TIMEOUT_MS = 10 * 6e4;
+var GRANT_COMMAND_OUTPUT_CAP_BYTES = 64 * 1024;
+var ARGV_MAX_WORDS = 256;
+var ARGV_WORD_MAX_LENGTH = 4096;
+function operatorSecretResolver(env = process.env) {
+  const providerByEnvVar = new Map(Object.entries(PROVIDER_KEY_ENV_VARS).map(([provider, envVar]) => [envVar, provider]));
+  return async (name) => {
+    const provider = providerByEnvVar.get(name);
+    if (provider) {
+      const saved = (await readProviderKeyStore(env))[provider];
+      if (saved)
+        return saved;
+    }
+    const raw = await readFile3(resolve7(dirname3(providerKeyStorePath(env)), "secrets.json"), "utf8").catch(() => void 0);
+    if (!raw)
+      return void 0;
+    try {
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return void 0;
+      const value = parsed[name];
+      return typeof value === "string" && value.length > 0 ? value : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+}
+function validateGrantArgv(value) {
+  if (!Array.isArray(value) || value.length === 0)
+    throw new Error("argv must be a non-empty array");
+  if (value.length > ARGV_MAX_WORDS)
+    throw new Error(`argv exceeds ${ARGV_MAX_WORDS} words`);
+  return value.map((word) => {
+    if (typeof word !== "string" || !word)
+      throw new Error("argv words must be non-empty strings");
+    if (word.length > ARGV_WORD_MAX_LENGTH || /[\0\r\n]/.test(word)) {
+      throw new Error("argv words must be single-line and bounded");
+    }
+    return word;
+  });
+}
+function matchCommandGrant(grants, workspaceId, argv) {
+  for (const grant of grants) {
+    if (grant.kind !== "command" || grant.workspaceId !== workspaceId)
+      continue;
+    let rule;
+    try {
+      rule = parseCommandGrantTarget(grant.target);
+    } catch {
+      continue;
+    }
+    if (commandGrantMatches(rule, argv))
+      return { grant, rule };
+  }
+  return void 0;
+}
+function capOutput(value, cap) {
+  if (Buffer.byteLength(value) <= cap)
+    return value;
+  const half = Math.floor(cap / 2);
+  const bytes = Buffer.from(value);
+  return `${bytes.subarray(0, half).toString("utf8")}
+\u2026[${bytes.length - cap} bytes omitted]\u2026
+${bytes.subarray(bytes.length - half).toString("utf8")}`;
+}
+function scrubSecrets(value, secrets) {
+  let scrubbed = value;
+  for (const [name, secret] of secrets) {
+    if (secret.length >= 4)
+      scrubbed = scrubbed.split(secret).join(`[${name}]`);
+  }
+  return scrubbed;
+}
+var GrantCommandRunner = class {
+  options;
+  rooms = /* @__PURE__ */ new Map();
+  resolveSecret;
+  constructor(options) {
+    this.options = options;
+    this.resolveSecret = options.resolveSecret ?? operatorSecretResolver(options.env ?? process.env);
+  }
+  register(roomId, room) {
+    this.rooms.set(roomId, room);
+  }
+  unregister(roomId) {
+    this.rooms.delete(roomId);
+  }
+  async run(input) {
+    if (typeof input.roomId !== "string" || !input.roomId)
+      throw new Error("roomId is required");
+    const room = this.rooms.get(input.roomId);
+    if (!room)
+      throw new Error("this daemon is not serving that Room");
+    const argv = validateGrantArgv(input.argv);
+    const live = await this.options.api.execute("listAgentGrants", { agentId: this.options.agentId });
+    const match = matchCommandGrant(live.grants, room.workspaceId, argv);
+    if (!match) {
+      throw new Error(`no approved command grant matches: ${argv.join(" ")}. Ask with request_grant kind=command first.`);
+    }
+    const { grant, rule } = match;
+    const secrets = /* @__PURE__ */ new Map();
+    for (const name of rule.secrets) {
+      const value = await this.resolveSecret(name);
+      if (!value)
+        throw new Error(`secret ${name} is not in the operator key store`);
+      secrets.set(name, value);
+    }
+    if (grant.status === "once") {
+      await this.options.api.execute("consumeAgentGrant", { grantId: grant.grantId });
+    }
+    const source = this.options.env ?? process.env;
+    const env = {
+      ...source.PATH ? { PATH: source.PATH } : {},
+      ...source.HOME ? { HOME: source.HOME } : {},
+      ...Object.fromEntries(secrets)
+    };
+    const cap = this.options.outputCapBytes ?? GRANT_COMMAND_OUTPUT_CAP_BYTES;
+    const outcome = await new Promise((resolveRun) => {
+      const child = execFile(argv[0], argv.slice(1), {
+        cwd: room.cwd,
+        env,
+        timeout: this.options.timeoutMs ?? GRANT_COMMAND_TIMEOUT_MS,
+        killSignal: "SIGKILL",
+        maxBuffer: cap * 4,
+        encoding: "utf8"
+      }, (error, stdout6, stderr) => {
+        const combined = [stdout6, stderr].filter(Boolean).join(stderr && stdout6 ? "\n" : "");
+        const failure = error;
+        const spawnFailure = Boolean(failure && typeof failure.code === "string");
+        resolveRun({
+          exitCode: spawnFailure ? null : child.exitCode ?? (typeof failure?.code === "number" ? failure.code : 0),
+          ...failure?.signal ? { signal: failure.signal } : {},
+          timedOut: Boolean(failure?.killed && failure?.signal === "SIGKILL"),
+          output: spawnFailure ? `${combined}${combined ? "\n" : ""}${failure.message}` : combined
+        });
+      });
+    });
+    const output = capOutput(scrubSecrets(outcome.output, secrets), cap);
+    const turn = room.turn();
+    const requester = turn?.requester ?? {
+      pubkey: grant.requestedBy,
+      ...grant.requestedByName ? { name: grant.requestedByName } : {}
+    };
+    const status = outcome.timedOut ? "timed out" : outcome.exitCode === null ? "error" : `exit ${outcome.exitCode}`;
+    await this.options.api.execute("postAgentActivity", {
+      agentId: this.options.agentId,
+      roomId: input.roomId,
+      requestId: turn?.requestId ?? `grant:${grant.grantId}`,
+      activity: [
+        {
+          kind: "tool",
+          title: `ran ${argv.join(" ")} under grant ${grant.grantId} \xB7 asked by ${requester.name ?? requester.pubkey.slice(0, 12)}`,
+          operation: "execute",
+          status,
+          command: argv.join(" "),
+          ...output ? { output } : {},
+          requestedBy: requester
+        }
+      ]
+    });
+    return {
+      grantId: grant.grantId,
+      exitCode: outcome.exitCode,
+      ...outcome.signal ? { signal: outcome.signal } : {},
+      timedOut: outcome.timedOut,
+      output
+    };
+  }
+};
+var GrantRunnerServer = class {
+  runner;
+  server;
+  endpoint;
+  constructor(runner) {
+    this.runner = runner;
+  }
+  async start() {
+    if (this.endpoint)
+      return this.endpoint;
+    const token = randomBytes(32).toString("base64url");
+    const server = createServer((request, response) => {
+      void this.handle(request, response, token);
+    });
+    await new Promise((resolveListen, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => resolveListen());
+    });
+    server.unref?.();
+    const address = server.address();
+    this.server = server;
+    this.endpoint = { url: `http://127.0.0.1:${address.port}`, token };
+    return this.endpoint;
+  }
+  async close() {
+    const server = this.server;
+    this.server = void 0;
+    this.endpoint = void 0;
+    if (!server)
+      return;
+    await new Promise((resolveClose) => server.close(() => resolveClose()));
+  }
+  async handle(request, response, token) {
+    const send = (status, body) => {
+      response.writeHead(status, { "content-type": "application/json" });
+      response.end(JSON.stringify(body));
+    };
+    if (request.headers.authorization !== `Bearer ${token}`) {
+      send(401, { error: "grant runner token required" });
+      return;
+    }
+    if (request.method !== "POST" || request.url !== "/run") {
+      send(404, { error: "not found" });
+      return;
+    }
+    const chunks = [];
+    for await (const chunk of request)
+      chunks.push(chunk);
+    try {
+      const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+      send(200, await this.runner.run({ roomId: body.roomId, argv: body.argv }));
+    } catch (error) {
+      send(400, { error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+};
+
 // apps/body/dist/monolith-corner-turn.js
-import { execFile as execFile2 } from "node:child_process";
-import { mkdir as mkdir4 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
+import { execFile as execFile3 } from "node:child_process";
+import { mkdir as mkdir6 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
 import { join as join4 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 
 // apps/body/dist/agent-home.js
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { chmod, copyFile, lstat, mkdir, readdir, realpath, rename, rm as rm2, symlink, unlink, writeFile } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename as basename3, dirname as dirname2, relative, resolve as resolve6, sep } from "node:path";
+import { chmod as chmod2, copyFile, lstat, mkdir as mkdir3, readdir, realpath, rename, rm as rm2, symlink, unlink, writeFile as writeFile4 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename3, dirname as dirname4, relative, resolve as resolve10, sep } from "node:path";
 
 // apps/body/dist/beeline-skill.js
 import { readFileSync as readFileSync3 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var USING_BEELINE_SKILL_NAME = "using-beeline";
 var BEELINE_ROOM_CAPABILITIES = [
   "The repository filesystem is read-only in this Room session.",
@@ -4304,7 +4722,7 @@ function runningBeelineReleaseId(env = process.env, read = (path) => readFileSyn
     const lib = env.BEELINE_LIB_DIR;
     if (!lib)
       return "source";
-    const manifest = JSON.parse(read(resolve5(lib, "bundle.json")));
+    const manifest = JSON.parse(read(resolve8(lib, "bundle.json")));
     return [manifest.version, manifest.commit].filter(Boolean).join("-") || "source";
   } catch {
     return "source";
@@ -4340,6 +4758,226 @@ var SQUIRE_GOVERNED_TOOLS = [
 ];
 var SQUIRE_GOVERNED_TOOL_SET = new Set(SQUIRE_GOVERNED_TOOLS);
 
+// apps/body/dist/openrouter-routing.js
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
+import { resolve as resolve9 } from "node:path";
+var OPENROUTER_ENDPOINTS_BASE_URL = "https://openrouter.ai/api/v1/models";
+var OPENROUTER_ROUTING_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var OPENROUTER_ROUTING_FETCH_TIMEOUT_MS = 1e4;
+var OPENROUTER_UPTIME_BAR = 98;
+var OPENROUTER_UPTIME_BAR_RELAXED = 95;
+var OPENROUTER_MIN_PROVIDERS = 2;
+var OPENROUTER_FALLBACK_PROVIDERS = ["deepinfra", "novita"];
+function openRouterModelId(model, env = {}) {
+  const trimmed = model?.trim();
+  if (!trimmed)
+    return void 0;
+  if (trimmed.startsWith("openrouter/")) {
+    const id = trimmed.slice("openrouter/".length);
+    return id.includes("/") ? id : void 0;
+  }
+  if (env.OPENROUTER_API_KEY?.trim() && /^[^/\s]+\/[^/\s][^\s]*$/.test(trimmed))
+    return trimmed;
+  return void 0;
+}
+function parseOpenRouterEndpoints(payload) {
+  const data = payload?.data;
+  const record2 = data && typeof data === "object" ? data : {};
+  const raw = Array.isArray(record2.endpoints) ? record2.endpoints : [];
+  const endpoints = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const endpoint2 = entry;
+    const tag = typeof endpoint2.tag === "string" ? endpoint2.tag : "";
+    const provider = tag.split("/")[0]?.trim() ?? "";
+    if (!provider)
+      continue;
+    const uptime = typeof endpoint2.uptime_last_30m === "number" ? endpoint2.uptime_last_30m : 0;
+    const contextLength = typeof endpoint2.context_length === "number" ? endpoint2.context_length : 0;
+    const supported = Array.isArray(endpoint2.supported_parameters) ? endpoint2.supported_parameters : [];
+    endpoints.push({ provider, uptime, contextLength, tools: supported.includes("tools") });
+  }
+  return {
+    endpoints,
+    contextLength: typeof record2.context_length === "number" ? record2.context_length : advertisedContextLength(endpoints)
+  };
+}
+function advertisedContextLength(endpoints) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const endpoint2 of endpoints) {
+    if (!endpoint2.tools || endpoint2.contextLength <= 0)
+      continue;
+    counts.set(endpoint2.contextLength, (counts.get(endpoint2.contextLength) ?? 0) + 1);
+  }
+  let best;
+  for (const [length, count] of counts) {
+    if (best === void 0) {
+      best = length;
+      continue;
+    }
+    const bestCount = counts.get(best) ?? 0;
+    if (count > bestCount || count === bestCount && length > best)
+      best = length;
+  }
+  return best;
+}
+function selectReliableOpenRouterProviders(endpoints, contextLength) {
+  const eligible = endpoints.filter((endpoint2) => endpoint2.tools && (contextLength === void 0 || endpoint2.contextLength >= contextLength));
+  const atBar = (bar) => {
+    const seen = /* @__PURE__ */ new Set();
+    return eligible.filter((endpoint2) => endpoint2.uptime >= bar).sort((left, right) => right.uptime - left.uptime).map((endpoint2) => endpoint2.provider).filter((provider) => seen.has(provider) ? false : (seen.add(provider), true));
+  };
+  const strict = atBar(OPENROUTER_UPTIME_BAR);
+  if (strict.length >= OPENROUTER_MIN_PROVIDERS) {
+    return { providers: strict, bar: OPENROUTER_UPTIME_BAR, contextLength };
+  }
+  const relaxed = atBar(OPENROUTER_UPTIME_BAR_RELAXED);
+  if (relaxed.length > 0) {
+    return { providers: relaxed, bar: OPENROUTER_UPTIME_BAR_RELAXED, contextLength };
+  }
+  return { providers: [], bar: null, contextLength };
+}
+function openRouterRoutingFor(providers) {
+  return {
+    only: [...providers],
+    order: [...providers],
+    allow_fallbacks: true,
+    require_parameters: true
+  };
+}
+function openRouterRoutingCacheDir(runtimeDir) {
+  return resolve9(runtimeDir, "openrouter-routing");
+}
+function cachePath(cacheDir, model) {
+  return resolve9(cacheDir, `${model.replace(/[^A-Za-z0-9._-]+/g, "_")}.json`);
+}
+async function readCache(cacheDir, model) {
+  try {
+    const parsed = JSON.parse(await readFile4(cachePath(cacheDir, model), "utf8"));
+    if (!parsed || typeof parsed !== "object")
+      return void 0;
+    const cached = parsed;
+    if (cached.model !== model || typeof cached.fetchedAt !== "number" || !Array.isArray(cached.providers) || !cached.providers.every((provider) => typeof provider === "string" && provider.length > 0)) {
+      return void 0;
+    }
+    return {
+      model,
+      fetchedAt: cached.fetchedAt,
+      providers: cached.providers,
+      bar: typeof cached.bar === "number" ? cached.bar : null
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function writeCache(cacheDir, value) {
+  await mkdir2(cacheDir, { recursive: true, mode: 448 });
+  await writeFile3(cachePath(cacheDir, value.model), `${JSON.stringify(value, null, 2)}
+`, {
+    mode: 384
+  });
+}
+function decision(model, providers, bar, source, note) {
+  const criteria = bar === null ? "fallback pair" : `uptime \u2265${bar}%, tools`;
+  const suffix = [
+    bar === OPENROUTER_UPTIME_BAR_RELAXED ? "bar lowered: fewer than 2 providers at 98%" : "",
+    source === "cache" ? "cached" : "",
+    source === "stale-cache" ? "stale cache" : "",
+    note ?? ""
+  ].filter(Boolean).join("; ");
+  return {
+    model,
+    routing: openRouterRoutingFor(providers),
+    providers: [...providers],
+    bar,
+    source,
+    line: `[body] openrouter routing for ${model}: ${providers.join(", ")} (${criteria}` + (suffix ? `; ${suffix})` : ")")
+  };
+}
+async function resolveOpenRouterRouting(input) {
+  const now2 = input.now ?? Date.now;
+  const cached = await readCache(input.cacheDir, input.model);
+  if (cached && now2() - cached.fetchedAt < OPENROUTER_ROUTING_CACHE_TTL_MS) {
+    return decision(input.model, cached.providers, cached.bar, "cache");
+  }
+  let failure;
+  try {
+    const doFetch = input.fetchImpl ?? fetch;
+    const response = await doFetch(`${OPENROUTER_ENDPOINTS_BASE_URL}/${input.model}/endpoints`, {
+      signal: AbortSignal.timeout(input.timeoutMs ?? OPENROUTER_ROUTING_FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      throw new Error(`HTTP ${response.status}`);
+    const { endpoints, contextLength } = parseOpenRouterEndpoints(await response.json());
+    if (endpoints.length === 0)
+      throw new Error("no endpoints listed");
+    const selected = selectReliableOpenRouterProviders(endpoints, contextLength);
+    if (selected.providers.length === 0) {
+      return decision(input.model, OPENROUTER_FALLBACK_PROVIDERS, null, "fallback", "no provider met the bar");
+    }
+    await writeCache(input.cacheDir, {
+      model: input.model,
+      fetchedAt: now2(),
+      providers: selected.providers,
+      bar: selected.bar
+    }).catch(() => void 0);
+    return decision(input.model, selected.providers, selected.bar, "live");
+  } catch (error) {
+    failure = error instanceof Error ? error.message : String(error);
+  }
+  if (cached) {
+    return decision(input.model, cached.providers, cached.bar, "stale-cache", `api unreachable: ${failure}`);
+  }
+  return decision(input.model, OPENROUTER_FALLBACK_PROVIDERS, null, "fallback", `api unreachable: ${failure}`);
+}
+function withOpenRouterModelRouting(value, pin) {
+  const root = value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+  const applyOverride = (provider) => {
+    if (!pin)
+      return provider;
+    const overrides = provider.modelOverrides && typeof provider.modelOverrides === "object" && !Array.isArray(provider.modelOverrides) ? { ...provider.modelOverrides } : {};
+    const existing = overrides[pin.model];
+    const override = existing && typeof existing === "object" && !Array.isArray(existing) ? { ...existing } : {};
+    const compat = override.compat && typeof override.compat === "object" && !Array.isArray(override.compat) ? { ...override.compat } : {};
+    override.compat = { ...compat, openRouterRouting: pin.routing };
+    overrides[pin.model] = override;
+    return { ...provider, modelOverrides: overrides };
+  };
+  if (Array.isArray(root.providers)) {
+    if (!pin)
+      return root;
+    const providers2 = root.providers.map((provider) => provider && typeof provider === "object" ? { ...provider } : provider);
+    const index = providers2.findIndex((provider) => provider && typeof provider === "object" && provider.name === "openrouter");
+    const current = applyOverride(index >= 0 ? providers2[index] : { name: "openrouter" });
+    if (index >= 0)
+      providers2[index] = current;
+    else
+      providers2.push(current);
+    root.providers = providers2;
+    return root;
+  }
+  const providers = root.providers && typeof root.providers === "object" ? { ...root.providers } : {};
+  if (pin) {
+    const current = providers.openrouter && typeof providers.openrouter === "object" && !Array.isArray(providers.openrouter) ? { ...providers.openrouter } : {};
+    providers.openrouter = applyOverride(current);
+  }
+  root.providers = providers;
+  return root;
+}
+function openRouterRoutingInput(config, selection, fetchImpl) {
+  const model = openRouterModelId(selection?.model, config.agentEnv);
+  if (!model || !config.openRouterRoutingCacheDir)
+    return {};
+  return {
+    openRouterRouting: {
+      model,
+      cacheDir: config.openRouterRoutingCacheDir,
+      ...fetchImpl ? { fetchImpl } : {}
+    }
+  };
+}
+
 // apps/body/dist/toml-section.js
 function scanLine(line, openString) {
   if (openString.kind) {
@@ -4523,54 +5161,21 @@ var PI_CUSTOM_MODEL_CONFIG = {
   source: ".pi/agent/models.json",
   target: "models.json"
 };
-var OPENROUTER_RELIABLE_PROVIDERS = ["deepinfra", "novita"];
-function withReliableOpenRouterRouting(value) {
-  const root = value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
-  const routing = {
-    only: [...OPENROUTER_RELIABLE_PROVIDERS],
-    order: [...OPENROUTER_RELIABLE_PROVIDERS],
-    allow_fallbacks: false,
-    require_parameters: true
-  };
-  if (Array.isArray(root.providers)) {
-    const providers2 = root.providers.map((provider) => provider && typeof provider === "object" ? { ...provider } : provider);
-    const index = providers2.findIndex((provider) => provider && typeof provider === "object" && provider.name === "openrouter");
-    const current2 = index >= 0 ? providers2[index] : { name: "openrouter" };
-    const compat2 = current2.compat && typeof current2.compat === "object" && !Array.isArray(current2.compat) ? { ...current2.compat } : {};
-    current2.compat = { ...compat2, openRouterRouting: routing };
-    if (index >= 0)
-      providers2[index] = current2;
-    else
-      providers2.push(current2);
-    root.providers = providers2;
-    return root;
-  }
-  const providers = root.providers && typeof root.providers === "object" ? { ...root.providers } : {};
-  const current = providers.openrouter && typeof providers.openrouter === "object" && !Array.isArray(providers.openrouter) ? { ...providers.openrouter } : {};
-  const compat = current.compat && typeof current.compat === "object" && !Array.isArray(current.compat) ? { ...current.compat } : {};
-  current.compat = {
-    ...compat,
-    openRouterRouting: routing
-  };
-  providers.openrouter = current;
-  root.providers = providers;
-  return root;
-}
 var CODEX_ROOM_AGENT_LOCKDOWN_TOML = "[agents]\nenabled = false\n";
 var CODEX_ROOM_WEB_SEARCH_TOML = "[features]\nstandalone_web_search = true\n";
 var HOME_SUBDIRS = ["user", "claude", "codex", "grok", "pi", "state", "cache", "tmp"];
 async function prepareRoomAgentHome(input) {
-  const root = resolve6(input.root);
-  const operatorHome = input.operatorHome ?? homedir2();
+  const root = resolve10(input.root);
+  const operatorHome = input.operatorHome ?? homedir3();
   try {
-    await mkdir(root, { recursive: true, mode: 448 });
+    await mkdir3(root, { recursive: true, mode: 448 });
     const rootStats = await lstat(root);
     if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
       throw new AgentHomeSecurityError(`agent home root is not an ordinary directory: ${root}`);
     }
     for (const subdir of HOME_SUBDIRS) {
-      const path = resolve6(root, subdir);
-      await mkdir(path, { recursive: true, mode: 448 });
+      const path = resolve10(root, subdir);
+      await mkdir3(path, { recursive: true, mode: 448 });
       await assertRealContainedDirectory(path, root);
     }
   } catch (error) {
@@ -4580,14 +5185,14 @@ async function prepareRoomAgentHome(input) {
     return {};
   }
   for (const credential of SHARED_CREDENTIALS) {
-    const source = resolve6(operatorHome, credential.source);
-    const target = resolve6(root, credential.dir, credential.target);
+    const source = resolve10(operatorHome, credential.source);
+    const target = resolve10(root, credential.dir, credential.target);
     if (!existsSync3(source) || existsSync3(target))
       continue;
     await symlink(source, target).catch(() => void 0);
   }
   const prior = agentHomeProvisionQueues.get(root) ?? Promise.resolve();
-  const provision = prior.catch(() => void 0).then(() => provisionAgentSkillsAndMcp(root, operatorHome, input.skillReleaseId ?? runningBeelineReleaseId(), input.failClosed ?? false, input.sharedSkills ?? []));
+  const provision = prior.catch(() => void 0).then(() => provisionAgentSkillsAndMcp(root, operatorHome, input.skillReleaseId ?? runningBeelineReleaseId(), input.failClosed ?? false, input.sharedSkills ?? [], input.openRouterRouting));
   agentHomeProvisionQueues.set(root, provision);
   try {
     await provision;
@@ -4597,19 +5202,19 @@ async function prepareRoomAgentHome(input) {
   }
   return roomAgentHomeEnv(root);
 }
-async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, failClosed, sharedSkills) {
+async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, failClosed, sharedSkills, openRouterRouting) {
   const managedSkills = [
     { name: USING_BEELINE_SKILL_NAME, content: usingBeelineSkillMarkdown(skillReleaseId) }
   ];
   const shared = await resolveSharedSkillSources(operatorHome, sharedSkills);
   for (const dir of AGENT_SKILL_DIRS) {
-    const target = resolve6(root, dir, "skills");
+    const target = resolve10(root, dir, "skills");
     await provisionManagedSkillsDir(target, managedSkills, shared, sharedSkills.length === 0);
   }
   for (const config of HARNESS_MCP_CONFIGS) {
     try {
-      const source = resolve6(operatorHome, config.toml);
-      const target = resolve6(root, config.dir, "config.toml");
+      const source = resolve10(operatorHome, config.toml);
+      const target = resolve10(root, config.dir, "config.toml");
       const mcpSection = existsSync3(source) ? filteredHarnessMcpToml(readFileSync4(source, "utf8")) : void 0;
       const section = config.dir === "codex" ? [CODEX_ROOM_AGENT_LOCKDOWN_TOML, CODEX_ROOM_WEB_SEARCH_TOML, mcpSection].filter(Boolean).join("\n") : mcpSection;
       if (!section) {
@@ -4624,8 +5229,8 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
     }
   }
   try {
-    const claudeJson = resolve6(operatorHome, ".claude.json");
-    const claudeTarget = resolve6(root, "claude", ".claude.json");
+    const claudeJson = resolve10(operatorHome, ".claude.json");
+    const claudeTarget = resolve10(root, "claude", ".claude.json");
     const mcpServers = existsSync3(claudeJson) ? readClaudeUserScopeMcpServers(claudeJson) : void 0;
     if (mcpServers && Object.keys(mcpServers).length > 0) {
       await writeIsolatedHarnessFile(claudeTarget, `${JSON.stringify({ mcpServers }, null, 2)}
@@ -4640,22 +5245,28 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
   }
   try {
     const settings2 = { permissions: { allow: ["WebSearch"] } };
-    await writeIsolatedHarnessFile(resolve6(root, "claude", "settings.json"), `${JSON.stringify(settings2, null, 2)}
+    await writeIsolatedHarnessFile(resolve10(root, "claude", "settings.json"), `${JSON.stringify(settings2, null, 2)}
 `);
   } catch (error) {
     if (failClosed)
       throw error;
     console.warn("[body] claude web-search settings provisioning failed:", error);
   }
-  await provisionPiCustomModelConfig(root, operatorHome, failClosed);
+  await provisionPiCustomModelConfig(root, operatorHome, failClosed, openRouterRouting);
 }
-async function provisionPiCustomModelConfig(root, operatorHome, failClosed) {
-  const source = resolve6(operatorHome, PI_CUSTOM_MODEL_CONFIG.source);
-  const target = resolve6(root, "pi", PI_CUSTOM_MODEL_CONFIG.target);
+async function provisionPiCustomModelConfig(root, operatorHome, failClosed, openRouterRouting) {
+  const source = resolve10(operatorHome, PI_CUSTOM_MODEL_CONFIG.source);
+  const target = resolve10(root, "pi", PI_CUSTOM_MODEL_CONFIG.target);
+  let decision2;
+  if (openRouterRouting) {
+    decision2 = await resolveOpenRouterRouting(openRouterRouting);
+    console.log(decision2.line);
+  }
+  const pin = decision2 ? { model: decision2.model, routing: decision2.routing } : void 0;
   try {
     const sourceStats = await lstat(source).catch(() => void 0);
     if (!sourceStats) {
-      await writeIsolatedHarnessFile(target, `${JSON.stringify(withReliableOpenRouterRouting({}), null, 2)}
+      await writeIsolatedHarnessFile(target, `${JSON.stringify(withOpenRouterModelRouting({}, pin), null, 2)}
 `);
       return;
     }
@@ -4667,7 +5278,7 @@ async function provisionPiCustomModelConfig(root, operatorHome, failClosed) {
       throw new AgentHomeSecurityError(`Pi custom model config resolves through a link: ${source}`);
     }
     const sourceValue = JSON.parse(readFileSync4(resolvedSource, "utf8"));
-    await writeIsolatedHarnessFile(target, `${JSON.stringify(withReliableOpenRouterRouting(sourceValue), null, 2)}
+    await writeIsolatedHarnessFile(target, `${JSON.stringify(withOpenRouterModelRouting(sourceValue, pin), null, 2)}
 `);
   } catch (error) {
     await unlink(target).catch(() => void 0);
@@ -4702,16 +5313,16 @@ function filteredHarnessMcpToml(source) {
   return extractTomlSections(source, ["mcp_servers"], excluded);
 }
 async function provisionManagedSkillsDir(target, managedSkills, sharedSkills, optionalShares) {
-  const parent = dirname2(target);
-  await assertRealContainedDirectory(parent, dirname2(parent));
-  const staged = resolve6(parent, `.skills.${process.pid}.${randomUUID()}.tmp`);
-  await mkdir(staged, { mode: 448 });
+  const parent = dirname4(target);
+  await assertRealContainedDirectory(parent, dirname4(parent));
+  const staged = resolve10(parent, `.skills.${process.pid}.${randomUUID()}.tmp`);
+  await mkdir3(staged, { mode: 448 });
   const names = new Set(managedSkills.map((skill) => skill.name));
   try {
     for (const skill of managedSkills) {
-      const skillDir = resolve6(staged, skill.name);
-      await mkdir(skillDir, { recursive: true });
-      await writeIsolatedHarnessFile(resolve6(skillDir, "SKILL.md"), skill.content);
+      const skillDir = resolve10(staged, skill.name);
+      await mkdir3(skillDir, { recursive: true });
+      await writeIsolatedHarnessFile(resolve10(skillDir, "SKILL.md"), skill.content);
     }
     for (const shared of sharedSkills) {
       if (names.has(shared.name)) {
@@ -4719,7 +5330,7 @@ async function provisionManagedSkillsDir(target, managedSkills, sharedSkills, op
       }
       names.add(shared.name);
       try {
-        await copySafeSkillTree(shared.source, resolve6(staged, shared.name), shared.source);
+        await copySafeSkillTree(shared.source, resolve10(staged, shared.name), shared.source);
       } catch (error) {
         if (!optionalShares)
           throw error;
@@ -4740,20 +5351,20 @@ async function resolveSharedSkillSources(operatorHome, names) {
   const seen = /* @__PURE__ */ new Set();
   const resolved = [];
   for (const relativeRoot of OPERATOR_SKILL_SOURCE_DIRS) {
-    const sourceRoot = resolve6(operatorHome, relativeRoot);
+    const sourceRoot = resolve10(operatorHome, relativeRoot);
     const rootStats = await lstat(sourceRoot).catch(() => void 0);
     if (!rootStats?.isDirectory() || rootStats.isSymbolicLink())
       continue;
     for (const entry of await readdir(sourceRoot)) {
       if (!isSharedSkillName(entry) || seen.has(entry))
         continue;
-      const candidate = resolve6(sourceRoot, entry);
+      const candidate = resolve10(sourceRoot, entry);
       try {
         const candidateStats = await lstat(candidate);
         if (!candidateStats.isDirectory() || candidateStats.isSymbolicLink())
           continue;
         assertContained(sourceRoot, candidate);
-        const skillMd = resolve6(candidate, "SKILL.md");
+        const skillMd = resolve10(candidate, "SKILL.md");
         const skillStats = await lstat(skillMd);
         if (!skillStats.isFile() || skillStats.isSymbolicLink() || skillStats.nlink !== 1) {
           throw new Error(`shared skill requires an ordinary SKILL.md: ${entry}`);
@@ -4777,8 +5388,8 @@ async function resolveExplicitSkillSources(operatorHome, names) {
   for (const name of unique) {
     const matches = [];
     for (const relativeRoot of OPERATOR_SKILL_SOURCE_DIRS) {
-      const sourceRoot = resolve6(operatorHome, relativeRoot);
-      const candidate = resolve6(sourceRoot, name);
+      const sourceRoot = resolve10(operatorHome, relativeRoot);
+      const candidate = resolve10(sourceRoot, name);
       const rootStats = await lstat(sourceRoot).catch(() => void 0);
       const candidateStats = await lstat(candidate).catch(() => void 0);
       if (!candidateStats)
@@ -4795,7 +5406,7 @@ async function resolveExplicitSkillSources(operatorHome, names) {
     if (matches.length !== 1) {
       throw new Error(matches.length === 0 ? `shared skill is unavailable: ${name}` : `shared skill source is ambiguous: ${name}`);
     }
-    const skillMd = resolve6(matches[0], "SKILL.md");
+    const skillMd = resolve10(matches[0], "SKILL.md");
     const skillStats = await lstat(skillMd).catch(() => void 0);
     if (!skillStats?.isFile() || skillStats.isSymbolicLink() || skillStats.nlink !== 1) {
       throw new Error(`shared skill requires an ordinary SKILL.md: ${name}`);
@@ -4806,7 +5417,7 @@ async function resolveExplicitSkillSources(operatorHome, names) {
 }
 function assertContained(root, candidate) {
   const rel = relative(root, candidate);
-  if (rel === ".." || rel.startsWith(`..${sep}`) || resolve6(root, rel) !== resolve6(candidate)) {
+  if (rel === ".." || rel.startsWith(`..${sep}`) || resolve10(root, rel) !== resolve10(candidate)) {
     throw new Error(`path escapes the agent skill boundary: ${candidate}`);
   }
 }
@@ -4821,7 +5432,7 @@ var BLOCKED_SHARED_FILENAMES = /^(?:\.env(?:\..*)?|auth\.json|\.credentials\.jso
 async function copySafeSkillTree(source, target, sourceRoot) {
   assertContained(sourceRoot, source);
   const resolvedSource = await realpath(source);
-  if (resolvedSource !== resolve6(source)) {
+  if (resolvedSource !== resolve10(source)) {
     throw new Error(`shared skill path resolves through a link: ${source}`);
   }
   assertContained(sourceRoot, resolvedSource);
@@ -4832,11 +5443,11 @@ async function copySafeSkillTree(source, target, sourceRoot) {
     throw new Error(`shared skill contains credential or configuration material: ${source}`);
   }
   if (stats.isDirectory()) {
-    await mkdir(target, { mode: 448 });
+    await mkdir3(target, { mode: 448 });
     for (const entry of await readdir(resolvedSource)) {
       if (entry === "." || entry === "..")
         throw new Error("invalid shared skill entry");
-      await copySafeSkillTree(resolve6(source, entry), resolve6(target, entry), sourceRoot);
+      await copySafeSkillTree(resolve10(source, entry), resolve10(target, entry), sourceRoot);
     }
     return;
   }
@@ -4844,34 +5455,34 @@ async function copySafeSkillTree(source, target, sourceRoot) {
     throw new Error(`shared skill contains a nonordinary file: ${source}`);
   }
   await copyFile(resolvedSource, target);
-  await chmod(target, 384);
+  await chmod2(target, 384);
 }
 async function writeIsolatedHarnessFile(path, content) {
-  const parent = dirname2(path);
+  const parent = dirname4(path);
   const parentStats = await lstat(parent);
   if (!parentStats.isDirectory() || parentStats.isSymbolicLink()) {
     throw new Error(`isolated harness parent is not a real directory: ${parent}`);
   }
-  const temporary = resolve6(parent, `.${basename3(path)}.${process.pid}.${randomUUID()}.tmp`);
+  const temporary = resolve10(parent, `.${basename3(path)}.${process.pid}.${randomUUID()}.tmp`);
   try {
-    await writeFile(temporary, content, { mode: 384, flag: "wx" });
-    await chmod(temporary, 384);
+    await writeFile4(temporary, content, { mode: 384, flag: "wx" });
+    await chmod2(temporary, 384);
     await rename(temporary, path);
   } finally {
     await unlink(temporary).catch(() => void 0);
   }
 }
 function roomAgentHomeEnv(root) {
-  const resolved = resolve6(root);
+  const resolved = resolve10(root);
   return {
-    HOME: resolve6(resolved, "user"),
-    CLAUDE_CONFIG_DIR: resolve6(resolved, "claude"),
-    CODEX_HOME: resolve6(resolved, "codex"),
-    GROK_HOME: resolve6(resolved, "grok"),
-    PI_CODING_AGENT_DIR: resolve6(resolved, "pi"),
-    XDG_STATE_HOME: resolve6(resolved, "state"),
-    XDG_CACHE_HOME: resolve6(resolved, "cache"),
-    TMPDIR: resolve6(resolved, "tmp")
+    HOME: resolve10(resolved, "user"),
+    CLAUDE_CONFIG_DIR: resolve10(resolved, "claude"),
+    CODEX_HOME: resolve10(resolved, "codex"),
+    GROK_HOME: resolve10(resolved, "grok"),
+    PI_CODING_AGENT_DIR: resolve10(resolved, "pi"),
+    XDG_STATE_HOME: resolve10(resolved, "state"),
+    XDG_CACHE_HOME: resolve10(resolved, "cache"),
+    TMPDIR: resolve10(resolved, "tmp")
   };
 }
 var HARNESS_STATE_ENV_VARS = [
@@ -4888,14 +5499,14 @@ function harnessStateDirsFromEnv(env) {
   for (const name of HARNESS_STATE_ENV_VARS) {
     const value = env[name];
     if (value)
-      stateDirs.push(resolve6(value));
+      stateDirs.push(resolve10(value));
   }
   const tmp = env.TMPDIR;
-  return { stateDirs, ...tmp ? { tmpDir: resolve6(tmp) } : {} };
+  return { stateDirs, ...tmp ? { tmpDir: resolve10(tmp) } : {} };
 }
 
 // apps/body/dist/attachment-delivery.js
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir4, writeFile as writeFile5 } from "node:fs/promises";
 import { basename as basename4, extname, join as join2 } from "node:path";
 var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 var FETCH_TIMEOUT_MS = 3e4;
@@ -4913,7 +5524,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
   if (!attachments.length)
     return [];
   const taken = /* @__PURE__ */ new Set();
-  await mkdir2(dir, { recursive: true });
+  await mkdir4(dir, { recursive: true });
   return Promise.all(attachments.map(async (attachment, index) => {
     const tooLarge = (bytes) => ({
       attachment,
@@ -4934,7 +5545,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
       if (bytes.length > MAX_ATTACHMENT_BYTES)
         return tooLarge(bytes.length);
       const path = join2(dir, safeFileName(attachment, index, taken));
-      await writeFile2(path, bytes);
+      await writeFile5(path, bytes);
       const mimeType = attachment.mimeType ?? response.headers.get("content-type") ?? "";
       return {
         attachment,
@@ -5047,8 +5658,23 @@ function sanitizeAgentReply(message) {
   return lines.slice(1).join("\n").trim();
 }
 
+// apps/body/dist/turn-failure-reason.js
+var TURN_FAILURE_REASON_MAX = 200;
+function redactToolDetail(value) {
+  return value.replace(/\b(["']?)(api[_-]?key|token|secret|password|passwd|authorization|credential|cookie|private[_-]?key)\1\s*[:=]\s*(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,}\]]+)/gi, '"$2": "[REDACTED]"').replace(/\b(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\S+)/g, (assignment) => `${assignment.slice(0, assignment.indexOf("="))}=[REDACTED]`).replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/gi, "[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\b(Bearer\s+)[^\s,]+/gi, "$1[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{12,}\b/g, "[REDACTED]").replace(/(--?(?:api[_-]?key|token|secret|password|authorization|credential|cookie)\s+)(?:"[^"]*"|'[^']*'|\S+)/gi, "$1[REDACTED]");
+}
+function distillTurnFailureReason(error) {
+  const raw = error instanceof Error ? error.message : typeof error === "string" ? error : error && typeof error === "object" && "message" in error ? String(error.message) : error == null ? "" : String(error);
+  const firstLine = raw.split(/\r?\n/).map((line) => line.trim()).find((line) => line && !/^at\s/.test(line)) ?? "";
+  const stripped = firstLine.replace(/^(?:[A-Za-z]*Error|Error):\s*/, "").replace(/\s+/g, " ");
+  const clean4 = redactToolDetail(stripped).trim();
+  if (!clean4)
+    return "turn failed";
+  return clean4.length > TURN_FAILURE_REASON_MAX ? `${clean4.slice(0, TURN_FAILURE_REASON_MAX - 1)}\u2026` : clean4;
+}
+
 // apps/body/dist/room-session.js
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 
 // apps/body/dist/read-only-policy.js
 var READ_ONLY_MCP_SERVER_NAME = "beeline-readonly-mcp";
@@ -5180,7 +5806,11 @@ function beelineAgentMcpServer(config, api, context) {
       { name: "BEELINE_DAEMON_ROOM_ID", value: context.roomId },
       { name: "BEELINE_DAEMON_WORKSPACE_ID", value: context.workspaceId },
       ...context.cornerId ? [{ name: "BEELINE_DAEMON_CORNER_ID", value: context.cornerId }] : [],
-      ...context.attachRoot ? [{ name: "BEELINE_ATTACH_ROOT", value: context.attachRoot }] : []
+      ...context.attachRoot ? [{ name: "BEELINE_ATTACH_ROOT", value: context.attachRoot }] : [],
+      ...context.grantRunner ? [
+        { name: "BEELINE_GRANT_RUNNER_URL", value: context.grantRunner.url },
+        { name: "BEELINE_GRANT_RUNNER_TOKEN", value: context.grantRunner.token }
+      ] : []
     ]
   };
 }
@@ -5194,14 +5824,14 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
     command: config.readonlyMcpCommand,
     args: [...config.readonlyMcpArgs ?? []],
     env: [
-      { name: "BEELINE_READONLY_ROOT", value: resolve7(cwd) },
+      { name: "BEELINE_READONLY_ROOT", value: resolve11(cwd) },
       ...config.agentHomeRoot ? [
         {
           name: "BEELINE_READONLY_AGENT_SKILLS_ROOT",
-          value: resolve7(config.agentHomeRoot, skillDir, "skills")
+          value: resolve11(config.agentHomeRoot, skillDir, "skills")
         }
       ] : [],
-      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve7(agentMemoryDir) }] : []
+      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve11(agentMemoryDir) }] : []
     ]
   };
 }
@@ -5209,8 +5839,8 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
 // apps/body/dist/bwrap-sandbox.js
 import { spawnSync } from "node:child_process";
 import { lstatSync as lstatSync2 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve8 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve12 } from "node:path";
 var DEFAULT_SANDBOX_POLICY = "bwrap";
 function isSandboxPolicy(value) {
   return value === "bwrap" || value === "off";
@@ -5242,12 +5872,12 @@ var HARNESS_HOME_STATE_DIRS = [
     dirs: [".grok"]
   }
 ];
-function harnessHomeStateDirs(agentCommand, home = homedir3()) {
+function harnessHomeStateDirs(agentCommand, home = homedir4()) {
   if (!agentCommand)
     return [];
   for (const { match, dirs } of HARNESS_HOME_STATE_DIRS) {
     if (match.test(agentCommand))
-      return dirs.map((dir) => resolve8(home, dir));
+      return dirs.map((dir) => resolve12(home, dir));
   }
   return [];
 }
@@ -5259,7 +5889,7 @@ var KNOWN_CREDENTIAL_MASK_PATHS = [
   ".git-credentials",
   ".secrets.env"
 ];
-function credentialMaskPaths(extraPaths, home = homedir3(), stat3 = (path) => {
+function credentialMaskPaths(extraPaths, home = homedir4(), stat3 = (path) => {
   try {
     const info = lstatSync2(path);
     return { isDirectory: info.isDirectory() };
@@ -5267,10 +5897,10 @@ function credentialMaskPaths(extraPaths, home = homedir3(), stat3 = (path) => {
     return void 0;
   }
 }, requiredPaths = []) {
-  const required = new Set(requiredPaths.map((path) => resolve8(path)));
+  const required = new Set(requiredPaths.map((path) => resolve12(path)));
   const candidates = [
-    ...KNOWN_CREDENTIAL_MASK_PATHS.map((entry) => resolve8(home, entry)),
-    ...(extraPaths ?? []).map((entry) => resolve8(entry))
+    ...KNOWN_CREDENTIAL_MASK_PATHS.map((entry) => resolve12(home, entry)),
+    ...(extraPaths ?? []).map((entry) => resolve12(entry))
   ];
   const seen = /* @__PURE__ */ new Set();
   const masks = [];
@@ -5297,7 +5927,7 @@ function normalize(paths) {
   for (const path of paths) {
     if (!path)
       continue;
-    seen.add(resolve8(path));
+    seen.add(resolve12(path));
   }
   return Array.from(seen).sort();
 }
@@ -5335,7 +5965,7 @@ function sandboxMountPlan(spec) {
     writable,
     quotaTmpfs: spec.workbench ? [
       {
-        target: resolve8(spec.workbench.dir),
+        target: resolve12(spec.workbench.dir),
         maxBytes: spec.workbench.maxBytes,
         maxInodes: spec.workbench.maxInodes,
         blockGit: true
@@ -5390,7 +6020,7 @@ function buildBwrapArgv(input) {
   for (const binding of quotaTmpfs) {
     args.push("--dir", binding.target, "--size", String(binding.maxBytes), "--tmpfs", binding.target);
     if (binding.blockGit)
-      args.push("--ro-bind", "/dev/null", resolve8(binding.target, ".git"));
+      args.push("--ro-bind", "/dev/null", resolve12(binding.target, ".git"));
   }
   args.push("--chdir", input.cwd);
   args.push("--die-with-parent");
@@ -5454,13 +6084,156 @@ function detectBwrapSandbox(options = {}) {
   };
 }
 
+// apps/body/dist/pi-turn-record.js
+import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
+import { resolve as resolve13 } from "node:path";
+function summarizeProviderError(errorMessage2) {
+  const trimmed = errorMessage2.trim();
+  const statusMatch = /^(\d{3}):\s*([\s\S]*)$/.exec(trimmed);
+  const status = statusMatch ? Number(statusMatch[1]) : void 0;
+  let body = statusMatch ? statusMatch[2].trim() : trimmed;
+  if (body.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(body);
+      const message = typeof parsed.message === "string" ? parsed.message : typeof parsed.error === "string" ? parsed.error : typeof parsed.error?.message === "string" ? parsed.error.message : void 0;
+      if (message)
+        body = message;
+    } catch {
+    }
+  }
+  const firstLine = body.split(/\r?\n/).find((line) => line.trim()) ?? "";
+  const reason = `provider error${status === void 0 ? "" : ` ${status}`}${firstLine ? `: ${firstLine.trim()}` : ""}`;
+  return status === void 0 ? { reason } : { reason, status };
+}
+async function sessionFileFromMap(home, sessionId) {
+  try {
+    const raw = await readFile5(resolve13(home, ".pi", "pi-acp", "session-map.json"), "utf8");
+    const map = JSON.parse(raw);
+    const file = map.sessions?.[sessionId]?.sessionFile;
+    return typeof file === "string" && file ? file : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function sessionFileFromLayout(piDir, sessionId) {
+  const sessionsRoot = resolve13(piDir, "sessions");
+  const suffix = `_${sessionId}.jsonl`;
+  let projects;
+  try {
+    projects = await readdir2(sessionsRoot);
+  } catch {
+    return void 0;
+  }
+  for (const project of projects) {
+    const dir = resolve13(sessionsRoot, project);
+    let files;
+    try {
+      files = await readdir2(dir);
+    } catch {
+      continue;
+    }
+    const match = files.find((file) => file.endsWith(suffix));
+    if (match)
+      return resolve13(dir, match);
+  }
+  return void 0;
+}
+function messageText(content) {
+  if (!Array.isArray(content))
+    return "";
+  return content.map((block2) => block2 && typeof block2 === "object" && block2.type === "text" ? String(block2.text ?? "") : "").join("").trim();
+}
+async function readPiTurnRecord(input) {
+  const piDir = input.agentEnv.PI_CODING_AGENT_DIR;
+  if (!piDir || !input.sessionId)
+    return void 0;
+  const file = (input.agentEnv.HOME ? await sessionFileFromMap(input.agentEnv.HOME, input.sessionId) : void 0) ?? await sessionFileFromLayout(piDir, input.sessionId);
+  if (!file)
+    return void 0;
+  let raw;
+  try {
+    raw = await readFile5(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  let sawUser = false;
+  let last;
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim())
+      continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (entry.type !== "message" || !entry.message)
+      continue;
+    if (entry.message.role === "user") {
+      sawUser = true;
+      last = void 0;
+    } else if (entry.message.role === "assistant") {
+      last = entry.message;
+    }
+  }
+  if (!sawUser && !last)
+    return void 0;
+  if (!last)
+    return { kind: "missing" };
+  if (last.stopReason === "error") {
+    return {
+      kind: "error",
+      ...summarizeProviderError(typeof last.errorMessage === "string" && last.errorMessage.trim() ? last.errorMessage : "unknown error")
+    };
+  }
+  const text2 = messageText(last.content);
+  if (text2)
+    return { kind: "answer", text: text2 };
+  return {
+    kind: "empty",
+    stopReason: typeof last.stopReason === "string" ? last.stopReason : "unknown"
+  };
+}
+
+// apps/body/dist/empty-turn.js
+async function explainEmptyAgentTurn(input) {
+  const streamFact = describeEmptyTurn(input.result, input.agentLabel);
+  if (!isPiAcpHarness(input.agentLabel))
+    return { reason: streamFact };
+  const record2 = await readPiTurnRecord({ agentEnv: input.agentEnv, sessionId: input.sessionId });
+  if (!record2)
+    return { reason: `pi left no readable turn record; ${streamFact}` };
+  switch (record2.kind) {
+    case "error":
+      return { reason: record2.reason, record: record2 };
+    case "empty":
+      return {
+        reason: `the model ended its turn with no text (stop reason ${record2.stopReason})`,
+        record: record2
+      };
+    case "answer":
+      return {
+        recoveredText: record2.text,
+        reason: "pi recorded the answer but the ACP stream delivered no text",
+        record: record2
+      };
+    case "missing":
+      return { reason: `pi recorded no assistant message for this turn; ${streamFact}`, record: record2 };
+  }
+}
+function isAccountOrProviderRefusal(record2) {
+  if (!record2 || record2.kind !== "error" || record2.status === void 0)
+    return false;
+  return [401, 402, 403, 407, 408, 429].includes(record2.status) || record2.status >= 500;
+}
+
 // apps/body/dist/runtime.js
-import { randomBytes as randomBytes5 } from "node:crypto";
-import { execFile } from "node:child_process";
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { execFile as execFile2 } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
-import { mkdir as mkdir3, readFile, readdir as readdir2, rename as rename2, stat, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, resolve as resolve9 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile6, readdir as readdir3, rename as rename2, stat, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname5, resolve as resolve14 } from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 import { promisify } from "node:util";
 
@@ -5608,7 +6381,7 @@ function createHasher(hashCons, info = {}) {
   Object.assign(hashC, info);
   return Object.freeze(hashC);
 }
-function randomBytes(bytesLength = 32) {
+function randomBytes2(bytesLength = 32) {
   anumber(bytesLength, "bytesLength");
   const cr = typeof globalThis === "object" ? globalThis.crypto : null;
   if (typeof cr?.getRandomValues !== "function")
@@ -5926,7 +6699,7 @@ var bytesToHex2 = bytesToHex;
 var concatBytes2 = (...arrays) => concatBytes(...arrays);
 var hexToBytes2 = (hex) => hexToBytes(hex);
 var isBytes2 = isBytes;
-var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
+var randomBytes3 = (bytesLength) => randomBytes2(bytesLength);
 var _0n = /* @__PURE__ */ BigInt(0);
 var _1n = /* @__PURE__ */ BigInt(1);
 var atitle2 = (title) => title ? `"${title}" ` : "";
@@ -6518,18 +7291,18 @@ function validateTableBytes(numPoints, fpBytes) {
   if (bytes > TABLE_BYTES_MAX)
     throw new Error("invalid window size: table would need ~" + Math.ceil(bytes / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
 }
-function probeRandomBytes(randomBytes6, length) {
-  if (randomBytes6 === void 0)
+function probeRandomBytes(randomBytes7, length) {
+  if (randomBytes7 === void 0)
     return void 0;
-  afunction(randomBytes6, "randomBytes");
+  afunction(randomBytes7, "randomBytes");
   try {
-    const probe = randomBytes6(length);
+    const probe = randomBytes7(length);
     if (!isBytes2(probe) || probe.length !== length)
       return void 0;
   } catch {
     return void 0;
   }
-  return randomBytes6;
+  return randomBytes7;
 }
 function validateMSMPoints(points, c2) {
   aarray(points, "points");
@@ -6622,9 +7395,9 @@ var ScalarMultiplier = class {
   baseCanBeBlinded;
   bits;
   // Parametrized with a given Point class (not individual point)
-  constructor(Point, randomBytes6) {
+  constructor(Point, randomBytes7) {
     validatePointCons(Point);
-    this.randomBytes = probeRandomBytes(randomBytes6, BLIND_BYTES);
+    this.randomBytes = probeRandomBytes(randomBytes7, BLIND_BYTES);
     this.Point = Point;
     this.BASE = Point.BASE;
     this.ZERO = Point.ZERO;
@@ -6912,7 +7685,7 @@ function weierstrass(params, extraOpts = {}) {
     randomBytes: "function"
   });
   const { endo, allowInfinityPoint } = extraOpts;
-  const randomBytes6 = extraOpts.randomBytes === void 0 ? randomBytes2 : extraOpts.randomBytes;
+  const randomBytes7 = extraOpts.randomBytes === void 0 ? randomBytes3 : extraOpts.randomBytes;
   if (endo) {
     if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
       throw new Error('invalid endo: expected "beta": bigint and "basises": array');
@@ -7324,7 +8097,7 @@ function weierstrass(params, extraOpts = {}) {
     }
   }
   const normalize2 = (points) => normalizeZ(Point, points);
-  const wnaf = new ScalarMultiplier(Point, randomBytes6);
+  const wnaf = new ScalarMultiplier(Point, randomBytes7);
   if (wnaf.bits >= 6)
     Point.BASE.precompute(6);
   Object.freeze(Point.prototype);
@@ -7433,7 +8206,7 @@ function challenge(...args) {
 function schnorrGetPublicKey(secretKey) {
   return schnorrGetExtPubKey(secretKey).bytes;
 }
-function schnorrSign(message, secretKey, auxRand = randomBytes(32)) {
+function schnorrSign(message, secretKey, auxRand = randomBytes2(32)) {
   const { Fn, BASE } = Pointk1;
   const m2 = abytes2(message, void 0, "message");
   const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey);
@@ -7483,7 +8256,7 @@ var schnorr = /* @__PURE__ */ (() => {
   const size = 32;
   const seedLength = 48;
   const randomSecretKey = (seed) => {
-    seed = seed === void 0 ? randomBytes(seedLength) : seed;
+    seed = seed === void 0 ? randomBytes2(seedLength) : seed;
     return mapHashToField(abytes2(seed, seedLength, "seed"), secp256k1_CURVE.n);
   };
   return Object.freeze({
@@ -7630,7 +8403,7 @@ function createHasher2(hashCons, info = {}) {
   Object.assign(hashC, info);
   return Object.freeze(hashC);
 }
-function randomBytes3(bytesLength = 32) {
+function randomBytes4(bytesLength = 32) {
   const cr = typeof globalThis === "object" ? globalThis.crypto : null;
   if (typeof cr?.getRandomValues !== "function")
     throw new Error("crypto.getRandomValues must be defined");
@@ -9326,7 +10099,7 @@ function getWLengths2(Fp, Fn) {
 }
 function ecdh(Point, ecdhOpts = {}) {
   const { Fn } = Point;
-  const randomBytes_ = ecdhOpts.randomBytes || randomBytes3;
+  const randomBytes_ = ecdhOpts.randomBytes || randomBytes4;
   const lengths = Object.assign(getWLengths2(Point.Fp, Fn), { seed: getMinHashLength2(Fn.ORDER) });
   function isValidSecretKey(secretKey) {
     try {
@@ -9391,7 +10164,7 @@ function ecdsa2(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes6 = ecdsaOpts.randomBytes || randomBytes3;
+  const randomBytes7 = ecdsaOpts.randomBytes || randomBytes4;
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -9533,7 +10306,7 @@ function ecdsa2(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e = extraEntropy === true ? randomBytes6(lengths.secretKey) : extraEntropy;
+      const e = extraEntropy === true ? randomBytes7(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes3(e, void 0, "extraEntropy"));
     }
     const seed = concatBytes3(...seedArgs);
@@ -9700,7 +10473,7 @@ function challenge2(...args) {
 function schnorrGetPublicKey2(secretKey) {
   return schnorrGetExtPubKey2(secretKey).bytes;
 }
-function schnorrSign2(message, secretKey, auxRand = randomBytes3(32)) {
+function schnorrSign2(message, secretKey, auxRand = randomBytes4(32)) {
   const { Fn } = Pointk12;
   const m2 = abytes3(message, void 0, "message");
   const { bytes: px, scalar: d } = schnorrGetExtPubKey2(secretKey);
@@ -9742,7 +10515,7 @@ function schnorrVerify2(signature, message, publicKey) {
 var schnorr2 = /* @__PURE__ */ (() => {
   const size = 32;
   const seedLength = 48;
-  const randomSecretKey = (seed = randomBytes3(seedLength)) => {
+  const randomSecretKey = (seed = randomBytes4(seedLength)) => {
     return mapHashToField2(seed, secp256k1_CURVE2.n);
   };
   return {
@@ -12106,7 +12879,7 @@ function encrypt2(secretKey, pubkey, text2) {
   const privkey = secretKey instanceof Uint8Array ? secretKey : hexToBytes3(secretKey);
   const key = secp256k1.getSharedSecret(privkey, hexToBytes3("02" + pubkey));
   const normalizedKey = getNormalizedX(key);
-  let iv = Uint8Array.from(randomBytes3(16));
+  let iv = Uint8Array.from(randomBytes4(16));
   let plaintext = utf8Encoder.encode(text2);
   let ciphertext = cbc(normalizedKey, iv).encrypt(plaintext);
   let ctb64 = base64.encode(new Uint8Array(ciphertext));
@@ -12477,7 +13250,7 @@ function decodePayload(payload) {
     mac: data.subarray(-32)
   };
 }
-function encrypt22(plaintext, conversationKey, nonce = randomBytes3(32)) {
+function encrypt22(plaintext, conversationKey, nonce = randomBytes4(32)) {
   const { chacha_key, chacha_nonce, hmac_key } = getMessageKeys(conversationKey, nonce);
   const padded = pad(plaintext);
   const ciphertext = chacha20(chacha_key, chacha_nonce, padded);
@@ -13992,23 +14765,23 @@ function decodeNsec(nsec) {
 }
 
 // apps/body/dist/runtime.js
-var execFileAsync = promisify(execFile);
+var execFileAsync = promisify(execFile2);
 var DEFAULT_AGENT_IDENTITY_NAME = "beeline-agent";
 var DEFAULT_BODY_IDENTITY_NAME = "beeline-body";
 var DEFAULT_DAEMON_MONOLITH_BASE_URL = "https://server.usebeeline.app";
 function defaultSupervisorRoot(env = process.env) {
-  return resolve9(env.XDG_STATE_HOME ?? resolve9(homedir4(), ".local", "state"));
+  return resolve14(env.XDG_STATE_HOME ?? resolve14(homedir5(), ".local", "state"));
 }
 function runtimeDirectory(supervisorRoot, publicKey) {
   if (!/^[0-9a-f]{64}$/i.test(publicKey))
     throw new Error("invalid agent public key");
-  return resolve9(supervisorRoot, "beeline", "agents", publicKey.toLowerCase());
+  return resolve14(supervisorRoot, "beeline", "agents", publicKey.toLowerCase());
 }
 function runtimeConfigPath(supervisorRoot, publicKey) {
-  return resolve9(runtimeDirectory(supervisorRoot, publicKey), "runtime.json");
+  return resolve14(runtimeDirectory(supervisorRoot, publicKey), "runtime.json");
 }
 function identityFromKey(value, name) {
-  const secretKey = value ? value.startsWith("nsec1") ? decodeNsec(value) : Uint8Array.from(Buffer.from(value, "hex")) : randomBytes5(32);
+  const secretKey = value ? value.startsWith("nsec1") ? decodeNsec(value) : Uint8Array.from(Buffer.from(value, "hex")) : randomBytes6(32);
   if (secretKey.length !== 32)
     throw new Error("identity secret key must be 32 bytes");
   return { name, secretKey, publicKey: getPublicKey2(secretKey) };
@@ -14035,15 +14808,15 @@ function runtimeAgentCommand(runtime) {
 }
 async function writeRuntimeRecord(runtime) {
   const path = runtimeConfigPath(runtime.supervisorRoot, runtime.agent.publicKey);
-  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile3(staged, `${JSON.stringify(runtime, null, 2)}
+  await writeFile6(staged, `${JSON.stringify(runtime, null, 2)}
 `, { mode: 384 });
   await rename2(staged, path);
   return path;
 }
 async function readRuntimeRecord(path) {
-  const parsed = JSON.parse(await readFile(path, "utf8"));
+  const parsed = JSON.parse(await readFile6(path, "utf8"));
   if (parsed.version !== 2 || !parsed.agent || !parsed.body || !parsed.communityId) {
     throw new Error(`invalid agent runtime record: ${path}`);
   }
@@ -14061,7 +14834,7 @@ async function migrateRuntimeRecordAccessPolicy(path) {
   return { runtime, migrated: true };
 }
 async function stageMonolithAgentRuntime(input) {
-  const supervisorRoot = input.supervisorRoot ? resolve9(input.supervisorRoot) : defaultSupervisorRoot();
+  const supervisorRoot = input.supervisorRoot ? resolve14(input.supervisorRoot) : defaultSupervisorRoot();
   const configPath = runtimeConfigPath(supervisorRoot, input.agentIdentity.publicKey);
   const configuredBaseUrl = input.monolithBaseUrl ?? DEFAULT_DAEMON_MONOLITH_BASE_URL;
   const baseUrl = new URL(configuredBaseUrl).origin;
@@ -14106,9 +14879,9 @@ async function stageMonolithAgentRuntime(input) {
   return { runtime, configPath };
 }
 async function runtimePaths(root) {
-  const agents = resolve9(root, "beeline", "agents");
-  const entries = await readdir2(agents, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => resolve9(agents, entry.name, "runtime.json"));
+  const agents = resolve14(root, "beeline", "agents");
+  const entries = await readdir3(agents, { withFileTypes: true }).catch(() => []);
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => resolve14(agents, entry.name, "runtime.json"));
 }
 async function findAgentRuntimeConfigPaths(env = process.env, _cwd = process.cwd()) {
   return runtimePaths(defaultSupervisorRoot(env));
@@ -14117,13 +14890,13 @@ async function findRuntimeConfigPaths(cwd = process.cwd(), env = process.env) {
   return findAgentRuntimeConfigPaths(env, cwd);
 }
 async function resolveRuntimeConfigPath(path) {
-  return resolve9(path);
+  return resolve14(path);
 }
 async function selectRuntimeConfigPaths(options) {
   const hostScope = true;
   const configs = await options.findHostRuntimes(options.cwd);
   const requestedPubkey = options.requestedPubkey;
-  const paths = requestedPubkey ? configs.filter((path) => dirname3(path).endsWith(requestedPubkey)) : [...new Set(configs)];
+  const paths = requestedPubkey ? configs.filter((path) => dirname5(path).endsWith(requestedPubkey)) : [...new Set(configs)];
   if (!paths.length)
     throw new Error(options.noRuntimeMessage(hostScope));
   if (options.requestedPubkey && paths.length > 1)
@@ -14132,7 +14905,7 @@ async function selectRuntimeConfigPaths(options) {
 }
 async function runtimeDaemonPid(configPath) {
   try {
-    const pid = Number((await readFile(resolve9(dirname3(configPath), "daemon.pid"), "utf8")).trim());
+    const pid = Number((await readFile6(resolve14(dirname5(configPath), "daemon.pid"), "utf8")).trim());
     if (!Number.isSafeInteger(pid) || pid <= 0)
       return null;
     process.kill(pid, 0);
@@ -14143,13 +14916,13 @@ async function runtimeDaemonPid(configPath) {
 }
 async function daemonIsThisRuntime(pid, configPath) {
   try {
-    const argv = (await readFile(`/proc/${pid}/cmdline`, "utf8")).split("\0").filter(Boolean);
+    const argv = (await readFile6(`/proc/${pid}/cmdline`, "utf8")).split("\0").filter(Boolean);
     const flag = argv.lastIndexOf("--config");
-    return flag > 0 && argv[flag - 1] === "daemon" && resolve9(argv[flag + 1]) === resolve9(configPath);
+    return flag > 0 && argv[flag - 1] === "daemon" && resolve14(argv[flag + 1]) === resolve14(configPath);
   } catch {
     try {
       const { stdout: stdout6 } = await execFileAsync("ps", ["-p", String(pid), "-o", "command="]);
-      return stdout6.includes(" daemon ") && stdout6.includes(resolve9(configPath));
+      return stdout6.includes(" daemon ") && stdout6.includes(resolve14(configPath));
     } catch {
       return false;
     }
@@ -14175,14 +14948,14 @@ async function stopRuntimeDaemon(path, opts = {}) {
   throw new Error(`agent daemon ${pid} did not stop after ${timeout}ms`);
 }
 async function launchRuntimeDaemon(configPath, opts = {}) {
-  const directory = dirname3(configPath);
-  await mkdir3(directory, { recursive: true, mode: 448 });
+  const directory = dirname5(configPath);
+  await mkdir5(directory, { recursive: true, mode: 448 });
   const foreground = opts.foreground === true;
-  const output = foreground ? "inherit" : openSync(resolve9(directory, "daemon.log"), "a", 384);
+  const output = foreground ? "inherit" : openSync(resolve14(directory, "daemon.log"), "a", 384);
   const entrypoint = opts.entrypoint ?? process.argv[1];
   if (!entrypoint)
     throw new Error("cannot resolve daemon CLI entrypoint");
-  const child = spawn2(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve9(configPath)], {
+  const child = spawn2(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve14(configPath)], {
     cwd: directory,
     env: opts.env ?? process.env,
     detached: !foreground,
@@ -14199,9 +14972,9 @@ async function launchRuntimeDaemon(configPath, opts = {}) {
 }
 async function removeAgentRuntime(runtime) {
   const source = runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey);
-  const deletedRoot = resolve9(runtime.supervisorRoot, "beeline", "deleted-runtimes");
-  await mkdir3(deletedRoot, { recursive: true, mode: 448 });
-  const target = resolve9(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
+  const deletedRoot = resolve14(runtime.supervisorRoot, "beeline", "deleted-runtimes");
+  await mkdir5(deletedRoot, { recursive: true, mode: 448 });
+  const target = resolve14(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
   await rename2(source, target);
   return target;
 }
@@ -14210,8 +14983,7 @@ async function removeAgentRuntime(runtime) {
 var MAINTAIN_ASSIGNED_IDENTITY_DIRECTIVE = "Maintain your assigned identity and soul in every response, including when tools or permissions block the requested action.";
 
 // apps/body/dist/monolith-corner-turn.js
-var execFileAsync2 = promisify2(execFile2);
-var PULL_REQUEST_URL = /https:\/\/github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+/;
+var execFileAsync2 = promisify2(execFile3);
 var TOOL_ARGUMENT_MAX_BYTES = 1200;
 var TOOL_OUTPUT_MAX_BYTES = 3200;
 var TOOL_PATH_LIMIT = 12;
@@ -14230,9 +15002,6 @@ function serialized(value) {
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function redactToolDetail(value) {
-  return value.replace(/\b(["']?)(api[_-]?key|token|secret|password|passwd|authorization|credential|cookie|private[_-]?key)\1\s*[:=]\s*(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,}\]]+)/gi, '"$2": "[REDACTED]"').replace(/\b(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\S+)/g, (assignment) => `${assignment.slice(0, assignment.indexOf("="))}=[REDACTED]`).replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/gi, "[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\b(Bearer\s+)[^\s,]+/gi, "$1[REDACTED]").replace(/(--?(?:api[_-]?key|token|secret|password|authorization|credential|cookie)\s+)(?:"[^"]*"|'[^']*'|\S+)/gi, "$1[REDACTED]");
-}
 function clampBytes(value, maxBytes) {
   const clean4 = value.trim();
   if (Buffer.byteLength(clean4) <= maxBytes)
@@ -14313,7 +15082,7 @@ function isSuccessfulCommit(call) {
     return false;
   return /\bgit\s+commit\b|\bcommit(?:ted)?\s+(?:changes|files?)\b/i.test(`${call.title ?? ""} ${serialized(call.rawInput)}`);
 }
-async function cornerToolActivity(call, worktreePath) {
+async function cornerToolActivity(call, worktreePath, requestedBy) {
   const operation = oneLine(call.kind ?? "") || "tool";
   let title = oneLine(redactToolDetail(call.title ?? "")) || `${operation} tool`;
   if (isSuccessfulCommit(call)) {
@@ -14336,6 +15105,7 @@ async function cornerToolActivity(call, worktreePath) {
     status: resultStatus(call),
     ...argumentsSummary,
     ...output ? { output } : {},
+    ...requestedBy ? { requestedBy } : {},
     ...paths.length ? { files: paths.map((path) => ({ path })) } : {}
   };
 }
@@ -14348,6 +15118,8 @@ var MonolithCornerTurnLoop = class {
   agent;
   client;
   sessionId;
+  /** The live session's environment, read back for pi's own turn record. */
+  agentEnv = {};
   turnIdentityInstructions = "";
   busy = false;
   forcedStop = false;
@@ -14355,9 +15127,17 @@ var MonolithCornerTurnLoop = class {
   activityTail = Promise.resolve();
   /** Session scratch directory attachments are downloaded into (`TMPDIR/beeline-attachments`). */
   attachmentDir;
+  /** The turn in flight and who asked for it, for ledger rows and the grant runner. */
+  currentTurn;
+  memberNames = /* @__PURE__ */ new Map();
   constructor(options) {
     this.options = options;
     this.agent = runtimeIdentity(options.runtime.agent);
+    options.grantRunner?.register(options.cornerId, {
+      workspaceId: options.workspaceId,
+      cwd: options.worktreePath,
+      turn: () => this.currentTurn
+    });
   }
   isBusy() {
     return this.busy;
@@ -14376,11 +15156,13 @@ var MonolithCornerTurnLoop = class {
       this.client.sessionCancel(this.sessionId);
     await this.options.scheduler.forceSuspend(this.options.cornerId);
   }
-  roster() {
-    return this.options.api.execute("getWorkspaceRoster", {
+  async roster() {
+    const roster = await this.options.api.execute("getWorkspaceRoster", {
       agentId: this.agent.publicKey,
       workspaceId: this.options.workspaceId
     });
+    this.memberNames = new Map(roster.members.map((member) => [member.identityId, member.name]));
+    return roster;
   }
   async activate() {
     if (this.client?.isAlive && this.sessionId)
@@ -14392,30 +15174,32 @@ var MonolithCornerTurnLoop = class {
       }),
       this.roster()
     ]);
-    await mkdir4(this.options.worktreePath, { recursive: true });
+    await mkdir6(this.options.worktreePath, { recursive: true });
+    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {}
+      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {},
+      ...openRouterRoutingInput(this.options.config, selection, this.options.fetchImpl)
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
-    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const agentEnv = {
       ...this.options.config.agentEnv,
       ...homeOverlay,
       GH_TOKEN: this.options.githubToken,
       GITHUB_TOKEN: this.options.githubToken
     };
+    this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
       kind: this.options.config.agentKind,
       command,
       args: this.options.config.agentArgs ?? []
     }, selection);
-    const operatorHome = this.options.config.operatorHome ?? homedir5();
+    const operatorHome = this.options.config.operatorHome ?? homedir6();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
     this.attachmentDir = tmpDir ? join4(tmpDir, "beeline-attachments") : void 0;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir4(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir6(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -14461,7 +15245,8 @@ var MonolithCornerTurnLoop = class {
         roomId: this.options.parentRoomId,
         workspaceId: this.options.workspaceId,
         cornerId: this.options.cornerId,
-        attachRoot: this.options.worktreePath
+        attachRoot: this.options.worktreePath,
+        ...this.options.grantRunnerEndpoint ? { grantRunner: this.options.grantRunnerEndpoint } : {}
       })
     ];
     const self = roster.members.find((member) => member.identityId === this.agent.publicKey);
@@ -14506,8 +15291,13 @@ var MonolithCornerTurnLoop = class {
       }
     };
   }
-  async prompt(requestId, trigger, attachments = []) {
+  async prompt(requestId, trigger, attachments = [], requestedById) {
     const { api, cornerId } = this.options;
+    const requester = requestedById ? {
+      pubkey: requestedById,
+      ...this.memberNames.get(requestedById) ? { name: this.memberNames.get(requestedById) } : {}
+    } : void 0;
+    this.currentTurn = { requestId, ...requester ? { requester } : {} };
     await api.execute("postAgentTurnReceipt", {
       agentId: this.agent.publicKey,
       roomId: cornerId,
@@ -14526,6 +15316,9 @@ var MonolithCornerTurnLoop = class {
           this.attachmentDir && attachments.length ? deliverAttachments(attachments, join4(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : Promise.resolve([])
         ]);
         const names = new Map(roster.members.map((member) => [member.identityId, member.name]));
+        const requestedBy = requester && !requester.name && names.get(requester.pubkey) ? { ...requester, name: names.get(requester.pubkey) } : requester;
+        if (requestedBy)
+          this.currentTurn = { requestId, requester: requestedBy };
         const transcript = conversation.items.slice(-120).map((message) => `${names.get(message.authorId) ?? "Beeline"} [${message.type}]: ${message.body}`).join("\n");
         const prompt = [
           this.turnIdentityInstructions,
@@ -14578,7 +15371,7 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
               return;
             publishedToolCalls.add(key);
             this.activityTail = this.activityTail.catch(() => void 0).then(async () => {
-              const activity = await cornerToolActivity(call, this.options.worktreePath);
+              const activity = await cornerToolActivity(call, this.options.worktreePath, requestedBy);
               await api.execute("postAgentActivity", {
                 agentId: this.agent.publicKey,
                 roomId: cornerId,
@@ -14605,9 +15398,19 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
         await this.activityTail;
         await this.draftTail;
         await this.activityTail;
-        const reply = stripAgentReplyPreamble(result.agentText).trim();
-        if (!reply)
-          throw new Error("ACP corner turn produced no durable reply");
+        let reply = stripAgentReplyPreamble(result.agentText).trim();
+        if (!reply) {
+          const explained = await explainEmptyAgentTurn({
+            agentLabel: this.options.config.agentCommand ?? this.options.config.agentBinary,
+            agentEnv: this.agentEnv,
+            sessionId,
+            result
+          });
+          reply = explained.recoveredText ? stripAgentReplyPreamble(explained.recoveredText).trim() : "";
+          if (!reply)
+            throw new Error(explained.reason);
+          console.warn(`[thin-core] corner ${cornerId} turn ${requestId}: ${explained.reason}`);
+        }
         const durableTail = narrationPostedChars > 0 ? stripAgentReplyPreamble(result.agentText.slice(narrationPostedChars)).trim() : reply;
         if (durableTail) {
           await api.execute("postRoomMessage", {
@@ -14617,17 +15420,6 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
             presentation: "message"
           });
         }
-        const pullRequest = reply.match(PULL_REQUEST_URL)?.[0];
-        const alreadyReady = conversation.items.some((item) => /\bPR ready for review\b/i.test(item.body));
-        if (pullRequest && !alreadyReady) {
-          await api.execute("postRoomMessage", {
-            roomId: cornerId,
-            requestId,
-            text: `PR ready for review
-${pullRequest}`,
-            presentation: "system"
-          });
-        }
         await api.execute("retractAgentLiveOutput", {
           agentId: this.agent.publicKey,
           roomId: cornerId,
@@ -14648,11 +15440,13 @@ ${pullRequest}`,
         roomId: cornerId,
         requestId,
         status: "failed",
-        generationId: `${this.agent.publicKey}:${cornerId}`
+        generationId: `${this.agent.publicKey}:${cornerId}`,
+        reason: distillTurnFailureReason(error)
       });
       throw error;
     } finally {
       this.busy = false;
+      this.currentTurn = void 0;
     }
   }
   async run() {
@@ -14685,7 +15479,14 @@ ${pullRequest}`,
               });
               if (!authority.member || authority.principalKind !== "human")
                 continue;
-              await this.prompt(item.id, item.body, item.attachments);
+              await this.prompt(item.id, item.body, item.attachments, item.authorId);
+              pollWithoutWait = true;
+              continue;
+            }
+            const grantDecision = item.type === "system" && item.mentionIds.includes(this.agent.publicKey) && parseGrantDecisionLine(item.body) !== void 0;
+            if (grantDecision) {
+              await this.prompt(item.id, `${item.body}
+This answers your grant request; resume the paused work. If approved and it is a command grant, run it with run_granted_command and the exact argv; if declined, try another way or say what you cannot do.`, [], item.authorId);
               pollWithoutWait = true;
               continue;
             }
@@ -14707,6 +15508,7 @@ ${pullRequest}`,
         }
       }
     } finally {
+      this.options.grantRunner?.unregister(cornerId);
       await this.options.scheduler.suspend(cornerId);
     }
   }
@@ -14726,13 +15528,13 @@ async function wait(ms, signal) {
 }
 
 // apps/body/dist/monolith-room-turn.js
-import { mkdir as mkdir5 } from "node:fs/promises";
-import { homedir as homedir6 } from "node:os";
+import { mkdir as mkdir7 } from "node:fs/promises";
+import { homedir as homedir7 } from "node:os";
 import { join as join5 } from "node:path";
 
 // packages/api-contract/dist/scheduled-prompts.js
 var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
-var SCHEDULED_PROMPT_PREFIX = "Scheduled: ";
+var SCHEDULE_RAN_VERB = "ran a schedule for";
 
 // apps/body/dist/monolith-room-turn.js
 function isRoomMcpPermissionRequest(request) {
@@ -14744,14 +15546,25 @@ function roomPrincipalMayAddressAgent(authority, humanPermitted) {
   return authority.member && (authority.principalKind === "agent" || authority.principalKind === "human" && humanPermitted);
 }
 function isScheduledPrompt(item, agentId) {
-  return item.type === "system" && item.body.startsWith(SCHEDULED_PROMPT_PREFIX) && item.mentionIds.includes(agentId);
+  return item.type === "system" && item.systemEvent?.verb === SCHEDULE_RAN_VERB && item.mentionIds.includes(agentId);
+}
+function inboxItemPromptBody(item, agentId) {
+  return isScheduledPrompt(item, agentId) ? item.systemEvent?.consequence ?? item.body : item.body;
+}
+function isGrantDecisionLine(item, agentId) {
+  return item.type === "system" && item.mentionIds.includes(agentId) && parseGrantDecisionLine(item.body) !== void 0;
 }
 function inboxItemTriggersTurn(item, agentId) {
   if (item.authorId === agentId)
     return false;
   if (!item.mentionIds.includes(agentId))
     return false;
-  return item.type === "message" || isScheduledPrompt(item, agentId);
+  return item.type === "message" || isScheduledPrompt(item, agentId) || isGrantDecisionLine(item, agentId);
+}
+function pendingGrantToolCall(call) {
+  if (!/(?:^|[._:/-])request_grant$/i.test(call.title ?? ""))
+    return false;
+  return /pending, card posted/i.test(typeof call.content === "string" ? call.content : JSON.stringify(call.content ?? ""));
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -14789,6 +15602,8 @@ var MonolithRoomTurnLoop = class {
   agent;
   client;
   sessionId;
+  /** The live session's environment, read back for pi's own turn record. */
+  agentEnv = {};
   busy = false;
   turnInstructionPrefix = "";
   draftTail = Promise.resolve();
@@ -14798,13 +15613,36 @@ var MonolithRoomTurnLoop = class {
   attachmentDir;
   /** Local copies already delivered this session, by message id, so transcript renders reuse them. */
   deliveredAttachments = /* @__PURE__ */ new Map();
+  /** Names from the latest roster read, for ledger bylines the runner writes. */
+  memberNames = /* @__PURE__ */ new Map();
+  /** The request id of the turn that paused on a grant card, until its decision arrives. */
+  pausedOnGrantRequestId;
   constructor(options) {
     this.options = options;
     this.agent = runtimeIdentity(options.runtime.agent);
+    options.grantRunner?.register(options.roomId, {
+      workspaceId: options.workspaceId,
+      cwd: options.cwd,
+      turn: () => this.currentTurnForRunner()
+    });
   }
   isBusy() {
     return this.busy;
   }
+  /** The turn a `request_grant` paused, if any (cleared when its decision resumes it). */
+  pausedGrantRequestId() {
+    return this.pausedOnGrantRequestId;
+  }
+  currentTurnForRunner() {
+    const active = this.activeTurn;
+    if (!active)
+      return void 0;
+    return { requestId: active.item.id, requester: this.requesterOf(active.item.authorId) };
+  }
+  requesterOf(authorId) {
+    const name = this.memberNames.get(authorId);
+    return { pubkey: authorId, ...name ? { name } : {} };
+  }
   currentPrincipalCanDrive(_workspaceId, principalId) {
     return Promise.resolve(isSenderPermitted(this.options.config.accessPolicy ?? LEGACY_ACCESS_POLICY, principalId, this.options.config.accessOwnerPubkey, this.options.config.accessAllowlist));
   }
@@ -14818,11 +15656,13 @@ var MonolithRoomTurnLoop = class {
       this.client.sessionCancel(this.sessionId);
     await this.options.scheduler.forceSuspend(this.options.roomId);
   }
-  roster() {
-    return this.options.api.execute("getWorkspaceRoster", {
+  async roster() {
+    const roster = await this.options.api.execute("getWorkspaceRoster", {
       agentId: this.agent.publicKey,
       workspaceId: this.options.workspaceId
     });
+    this.memberNames = new Map(roster.members.map((member) => [member.identityId, member.name]));
+    return roster;
   }
   /** Download a message's attachments into the session scratch directory once. */
   async deliver(item) {
@@ -14847,25 +15687,27 @@ var MonolithRoomTurnLoop = class {
       this.options.api.execute("getRoomRepositoryState", { roomId: this.options.roomId })
     ]);
     const directMessage = Array.isArray(repositoryState.directParticipants) && repositoryState.directParticipants.length === 2;
-    await mkdir5(this.options.cwd, { recursive: true });
+    await mkdir7(this.options.cwd, { recursive: true });
+    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {}
+      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {},
+      ...openRouterRoutingInput(this.options.config, selection, this.options.fetchImpl)
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
-    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const agentEnv = { ...this.options.config.agentEnv, ...homeOverlay };
+    this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
       kind: this.options.config.agentKind,
       command,
       args: this.options.config.agentArgs ?? []
     }, selection);
-    const operatorHome = this.options.config.operatorHome ?? homedir6();
+    const operatorHome = this.options.config.operatorHome ?? homedir7();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
     this.attachmentDir = tmpDir ? join5(tmpDir, "beeline-attachments") : void 0;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir5(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir7(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -14899,7 +15741,8 @@ var MonolithRoomTurnLoop = class {
         roomId: this.options.roomId,
         workspaceId: this.options.workspaceId,
         attachRoot: this.options.cwd,
-        directMessage
+        directMessage,
+        ...this.options.grantRunnerEndpoint ? { grantRunner: this.options.grantRunnerEndpoint } : {}
       })
     ];
     const self = roster.members.find((member) => member.identityId === this.agent.publicKey);
@@ -14987,6 +15830,8 @@ var MonolithRoomTurnLoop = class {
     const api = this.options.api;
     this.busy = true;
     try {
+      if (!this.memberNames.has(item.authorId))
+        await this.roster().catch(() => void 0);
       await api.execute("postAgentTurnReceipt", {
         agentId: this.agent.publicKey,
         roomId: this.options.roomId,
@@ -14998,7 +15843,14 @@ var MonolithRoomTurnLoop = class {
         agentId: this.agent.publicKey,
         roomId: this.options.roomId,
         requestId: item.id,
-        activity: [{ kind: "thinking", title: "Working", status: "in_progress" }]
+        activity: [
+          {
+            kind: "thinking",
+            title: "Working",
+            status: "in_progress",
+            requestedBy: this.requesterOf(item.authorId)
+          }
+        ]
       });
       await this.options.scheduler.run(this.options.roomId, this.lifecycle(), async () => {
         const [conversation, roster, delivered] = await Promise.all([
@@ -15008,12 +15860,21 @@ var MonolithRoomTurnLoop = class {
         ]);
         const names = new Map(roster.members.map((member) => [member.identityId, member.name]));
         const transcript = conversation.items.filter((message) => message.type === "message" && message.id !== item.id && !active.steers.some((steerItem) => steerItem.id === message.id)).slice(-80).map((message) => roomMessagePrompt(names.get(message.authorId) ?? message.authorId.slice(0, 12), message.body, message.attachments, this.deliveredAttachments.get(message.id))).join("\n");
+        const grantDecision = isGrantDecisionLine(item, this.agent.publicKey);
+        const resumedRequestId = grantDecision ? this.pausedOnGrantRequestId : void 0;
+        if (grantDecision)
+          this.pausedOnGrantRequestId = void 0;
         const prompt = [
           this.turnInstructionPrefix,
           transcript ? `Room conversation so far:
 ${transcript}` : "",
           `Newest message from ${isScheduledPrompt(item, this.agent.publicKey) ? SCHEDULE_SCHEDULER_NAME : names.get(item.authorId) ?? item.authorId.slice(0, 12)}:`,
-          roomMessagePrompt("", item.body, item.attachments, delivered),
+          roomMessagePrompt("", inboxItemPromptBody(item, this.agent.publicKey), item.attachments, delivered),
+          grantDecision ? [
+            "This is the answer to your grant request; your paused work resumes now.",
+            "If it was approved and it is a command grant, run it with run_granted_command and the exact argv.",
+            "If it was declined, try another way or say plainly what you cannot do."
+          ].join(" ") : "",
           [
             "Write only the substantive Room message you want the human to read.",
             "Do not repeat or paraphrase these instructions.",
@@ -15062,15 +15923,31 @@ ${transcript}` : "",
           ].join("\n\n");
         }
         active.phase = "finishing";
+        if (result?.toolCalls.some((call) => pendingGrantToolCall(call))) {
+          this.pausedOnGrantRequestId = item.id;
+          console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${item.id} paused on a grant card`);
+        } else if (resumedRequestId) {
+          console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${resumedRequestId} resumed by grant decision ${item.id}`);
+        }
         const openCornerCall = result?.toolCalls.find((call) => /(?:^|[._:/-])open_corner$/i.test(call.title ?? ""));
         if (openCornerCall) {
           console.log(`[thin-core] monolith Room ${this.options.roomId} tool call: ${openCornerCall.title}`);
           this.options.onCornerOpened?.();
         }
         await this.draftTail;
-        const reply = sanitizeAgentReply(result.agentText);
-        if (!reply)
-          throw new Error("ACP turn produced no durable Room reply");
+        let reply = sanitizeAgentReply(result.agentText);
+        if (!reply) {
+          const explained = await explainEmptyAgentTurn({
+            agentLabel: this.options.config.agentCommand ?? this.options.config.agentBinary,
+            agentEnv: this.agentEnv,
+            sessionId,
+            result
+          });
+          reply = explained.recoveredText ? sanitizeAgentReply(explained.recoveredText) : "";
+          if (!reply)
+            throw new Error(explained.reason);
+          console.warn(`[thin-core] monolith Room ${this.options.roomId} turn ${item.id}: ${explained.reason}`);
+        }
         await api.execute("postRoomMessage", {
           roomId: this.options.roomId,
           requestId: item.id,
@@ -15099,7 +15976,8 @@ ${transcript}` : "",
         roomId: this.options.roomId,
         requestId: item.id,
         status: "failed",
-        generationId: `${this.agent.publicKey}:${this.options.roomId}`
+        generationId: `${this.agent.publicKey}:${this.options.roomId}`,
+        reason: distillTurnFailureReason(error)
       });
       throw error;
     } finally {
@@ -15138,7 +16016,7 @@ ${transcript}` : "",
           for (const item of inbox.items) {
             if (!inboxItemTriggersTurn(item, this.agent.publicKey))
               continue;
-            if (!isScheduledPrompt(item, this.agent.publicKey)) {
+            if (!isScheduledPrompt(item, this.agent.publicKey) && !isGrantDecisionLine(item, this.agent.publicKey)) {
               const authority = await api.execute("getRoomAuthority", {
                 roomId,
                 principalId: item.authorId
@@ -15168,6 +16046,7 @@ ${transcript}` : "",
       }
     } finally {
       clearInterval(heartbeat);
+      this.options.grantRunner?.unregister(roomId);
       if (this.activeTurn?.phase === "prompting" && this.client && this.sessionId) {
         this.client.sessionCancel(this.sessionId);
       }
@@ -15547,7 +16426,7 @@ async function mapWithConcurrency(values, limit, visit) {
     }
   }));
 }
-var execFileAsync3 = promisify3(execFile3);
+var execFileAsync3 = promisify3(execFile4);
 var RoomRuntimeCoordinator = class {
   configPath;
   baseConfig;
@@ -15567,6 +16446,9 @@ var RoomRuntimeCoordinator = class {
   workspaceRemovalConfirmations = 0;
   roomRemovalConfirmations = /* @__PURE__ */ new Map();
   confirmationPending = false;
+  /** One command-grant runner per daemon; Rooms and corners register their checkouts on it. */
+  grantRunner;
+  grantRunnerServer;
   constructor(runtime, configPath, baseConfig, options) {
     this.configPath = configPath;
     this.baseConfig = baseConfig;
@@ -15576,6 +16458,11 @@ var RoomRuntimeCoordinator = class {
     this.runtime = runtime;
     this.agent = runtimeIdentity(runtime.agent);
     this.now = options.now ?? Date.now;
+    this.grantRunner = new GrantCommandRunner({
+      api: options.daemonApi,
+      agentId: this.agent.publicKey
+    });
+    this.grantRunnerServer = new GrantRunnerServer(this.grantRunner);
     this.watchdogStaleMs = options.watchdogStaleMs ?? DEFAULT_ROOM_WATCHDOG_STALE_MS;
     this.reconcileHeartbeatMs = options.reconcileHeartbeatMs ?? DEFAULT_RECONCILE_HEARTBEAT_MS;
     this.drainDeadlineMs = options.drainDeadlineMs ?? DEFAULT_DRAIN_DEADLINE_MS;
@@ -15602,7 +16489,15 @@ var RoomRuntimeCoordinator = class {
     return this.reconcileHeartbeatMs;
   }
   isWorkspaceIdle() {
-    return [...this.running.values()].every((room) => !room.body.isBusy());
+    return this.activeTurnCount() === 0;
+  }
+  /** Turns executing right now. Serving a Room or corner with no turn in flight is idle. */
+  activeTurnCount() {
+    let count = 0;
+    for (const room of this.running.values())
+      if (room.body.isBusy())
+        count += 1;
+    return count;
   }
   quiesceForUpdateIfIdle() {
     if (!this.isWorkspaceIdle())
@@ -15698,13 +16593,13 @@ var RoomRuntimeCoordinator = class {
     return this.runtime.rooms.find((room) => room.channelId === roomId);
   }
   roomRoot(roomId) {
-    return this.roomRecord(roomId)?.root ?? resolve10(dirname4(this.configPath), "rooms", roomId);
+    return this.roomRecord(roomId)?.root ?? resolve15(dirname6(this.configPath), "rooms", roomId);
   }
   roomAgentHomeRoot(workspaceRoot, required = false) {
     const flag = process.env.BUZZY_BODY_ROOM_HOME;
     if (!required && flag === "0")
       return void 0;
-    const home = resolve10(workspaceRoot, "agent-home");
+    const home = resolve15(workspaceRoot, "agent-home");
     if (!required && flag !== "1" && !existsSync4(home) && existsSync4(workspaceRoot))
       return void 0;
     try {
@@ -15721,19 +16616,30 @@ var RoomRuntimeCoordinator = class {
     return {
       ...this.baseConfig,
       workspaceRoot,
-      agentPrivateRoot: resolve10(workspaceRoot, "agent-private"),
-      agentMemoryRoot: resolve10(dirname4(this.configPath), "memory"),
+      agentPrivateRoot: resolve15(workspaceRoot, "agent-private"),
+      agentMemoryRoot: resolve15(dirname6(this.configPath), "memory"),
+      openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname6(this.configPath)),
       ...agentHomeRoot ? { agentHomeRoot } : {}
     };
   }
+  /** The loopback door for run_granted_command; started once, on first use. */
+  grantRunnerEndpoint() {
+    return this.grantRunnerServer.start().catch((error) => {
+      console.error("[thin-core] grant runner unavailable; run_granted_command is off:", error);
+      return void 0;
+    });
+  }
   async startRoom(roomId) {
     const controller = new AbortController();
     const cwd = await this.materializeRoomCheckout(roomId);
+    const grantRunnerEndpoint = await this.grantRunnerEndpoint();
     const startedAt = this.now();
     const loop = new MonolithRoomTurnLoop({
       roomId,
       workspaceId: this.runtime.communityId,
       cwd,
+      grantRunner: this.grantRunner,
+      ...grantRunnerEndpoint ? { grantRunnerEndpoint } : {},
       runtime: this.runtime,
       config: this.roomConfig(roomId),
       api: this.options.daemonApi,
@@ -15778,12 +16684,12 @@ var RoomRuntimeCoordinator = class {
       return this.roomRoot(roomId);
     const remote = roomCheckoutRemote(repository.remote);
     const targetBranch = repository.targetBranch || "main";
-    const checkoutId = createHash("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
-    const path = resolve10(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
-    await mkdir6(dirname4(path), { recursive: true, mode: 448 });
+    const checkoutId = createHash2("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
+    const path = resolve15(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
+    await mkdir8(dirname6(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.options.daemonApi.execute("getRoomGitHubToken", { roomId }) : void 0;
     const env = token ? githubGitEnv(token.token) : process.env;
-    if (!existsSync4(resolve10(path, ".git"))) {
+    if (!existsSync4(resolve15(path, ".git"))) {
       await execFileAsync3("git", ["clone", "--no-checkout", remote, path], {
         env,
         maxBuffer: 4 * 1024 * 1024
@@ -15845,9 +16751,12 @@ var RoomRuntimeCoordinator = class {
         });
       }
       const controller = new AbortController();
+      const grantRunnerEndpoint = await this.grantRunnerEndpoint();
       const startedAt = this.now();
       const loop = new MonolithCornerTurnLoop({
         cornerId: corner.cornerId,
+        grantRunner: this.grantRunner,
+        ...grantRunnerEndpoint ? { grantRunnerEndpoint } : {},
         parentRoomId: corner.parentRoomId,
         workspaceId: this.runtime.communityId,
         objective,
@@ -15900,13 +16809,13 @@ var RoomRuntimeCoordinator = class {
   }
   async materializeCornerWorktree(input) {
     const remote = githubHttpsRemote(input.remote);
-    const repositoryHash = createHash("sha256").update(remote).digest("hex").slice(0, 24);
-    const gitCommonDir = resolve10(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
-    const path = resolve10(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
-    await mkdir6(dirname4(gitCommonDir), { recursive: true, mode: 448 });
-    await mkdir6(dirname4(path), { recursive: true, mode: 448 });
+    const repositoryHash = createHash2("sha256").update(remote).digest("hex").slice(0, 24);
+    const gitCommonDir = resolve15(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
+    const path = resolve15(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
+    await mkdir8(dirname6(gitCommonDir), { recursive: true, mode: 448 });
+    await mkdir8(dirname6(path), { recursive: true, mode: 448 });
     const authEnv = githubGitEnv(input.token);
-    if (!existsSync4(resolve10(gitCommonDir, "HEAD"))) {
+    if (!existsSync4(resolve15(gitCommonDir, "HEAD"))) {
       await execFileAsync3("git", ["clone", "--bare", remote, gitCommonDir], {
         env: authEnv,
         maxBuffer: 4 * 1024 * 1024
@@ -15919,7 +16828,7 @@ var RoomRuntimeCoordinator = class {
       "origin",
       `+refs/heads/${input.targetBranch}:refs/remotes/origin/${input.targetBranch}`
     ], { env: authEnv, maxBuffer: 4 * 1024 * 1024 });
-    if (!existsSync4(resolve10(path, ".git"))) {
+    if (!existsSync4(resolve15(path, ".git"))) {
       await rm3(path, { recursive: true, force: true });
       await execFileAsync3("git", [
         `--git-dir=${gitCommonDir}`,
@@ -15956,7 +16865,7 @@ var RoomRuntimeCoordinator = class {
       `${this.agent.publicKey.slice(0, 16)}@users.noreply.github.com`
     ]);
     const top = await execFileAsync3("git", ["-C", path, "rev-parse", "--show-toplevel"]);
-    if (resolve10(top.stdout.trim()) !== resolve10(path)) {
+    if (resolve15(top.stdout.trim()) !== resolve15(path)) {
       throw new Error(`corner worktree escaped its isolated root: ${top.stdout.trim()}`);
     }
     return { path, gitCommonDir };
@@ -16023,6 +16932,7 @@ var RoomRuntimeCoordinator = class {
       await Promise.allSettled(rooms.map((room) => room.body.forceRecoverRoom()));
       await drained;
     }
+    await this.grantRunnerServer.close();
     await this.scheduler.dispose();
   }
 };
@@ -16081,6 +16991,9 @@ var ThinDaemonCore = class {
   isWorkspaceIdle() {
     return this.roomRuntime.isWorkspaceIdle();
   }
+  activeTurnCount() {
+    return this.roomRuntime.activeTurnCount();
+  }
   quiesceForUpdateIfIdle() {
     return this.roomRuntime.quiesceForUpdateIfIdle();
   }
@@ -16127,7 +17040,7 @@ var ThinDaemonCore = class {
 };
 
 // apps/body/dist/daemon-api-client.js
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 var DaemonApiError = class extends Error {
   status;
   retryable;
@@ -16186,8 +17099,8 @@ var DaemonApiClient = class {
 };
 async function activateDaemonTransport(path, fetchImpl = fetch) {
   const runtime = await readRuntimeRecord(path);
-  const expectedPath = resolve11(runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey), "runtime.json");
-  if (resolve11(path) !== expectedPath) {
+  const expectedPath = resolve16(runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey), "runtime.json");
+  if (resolve16(path) !== expectedPath) {
     throw new Error(`refusing daemon token exchange outside canonical runtime path: ${path}`);
   }
   const transport = runtime.transport;
@@ -16226,17 +17139,17 @@ async function activateDaemonTransport(path, fetchImpl = fetch) {
 }
 
 // apps/body/dist/start-command.js
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 var import_picocolors = __toESM(require_picocolors(), 1);
 
 // apps/body/dist/systemd.js
-import { execFile as execFile4 } from "node:child_process";
-import { mkdir as mkdir7, readFile as readFile2, writeFile as writeFile4 } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
-import { dirname as dirname5, resolve as resolve12 } from "node:path";
+import { execFile as execFile5 } from "node:child_process";
+import { mkdir as mkdir9, readFile as readFile7, writeFile as writeFile7 } from "node:fs/promises";
+import { homedir as homedir8 } from "node:os";
+import { dirname as dirname7, resolve as resolve17 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
-var execFileAsync4 = promisify4(execFile4);
+var execFileAsync4 = promisify4(execFile5);
 var DELIBERATE_REMOVAL_EXIT_STATUS = 78;
 var DAEMON_DISTRESS_EXIT_STATUS = 77;
 var UNKNOWN_AGENT_EXIT_STATUS = 79;
@@ -16274,10 +17187,10 @@ WantedBy=default.target
 `;
 }
 function isCanonicalInstalledLauncher(env = process.env, invocationPath = process.argv[1]) {
-  const home = env.HOME?.trim() || homedir7();
-  const expectedLibDir = resolve12(home, ".local", "lib", "beeline");
+  const home = env.HOME?.trim() || homedir8();
+  const expectedLibDir = resolve17(home, ".local", "lib", "beeline");
   const expectedPrefix = `${expectedLibDir}/`;
-  return resolve12(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve12(invocationPath).startsWith(expectedPrefix);
+  return resolve17(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve17(invocationPath).startsWith(expectedPrefix);
 }
 function assertCanonicalInstalledLauncher(env, invocationPath) {
   if (isCanonicalInstalledLauncher(env, invocationPath))
@@ -16285,8 +17198,8 @@ function assertCanonicalInstalledLauncher(env, invocationPath) {
   throw new Error("refusing to modify the shared Beeline systemd unit outside the canonical ~/.local/bin/beeline launcher");
 }
 function systemdUserUnitPath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve12(homedir7(), ".config");
-  return resolve12(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve17(homedir8(), ".config");
+  return resolve17(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
 }
 var runSystemctl = async (args) => {
   const result = await execFileAsync4("systemctl", ["--user", ...args], {
@@ -16302,10 +17215,10 @@ async function installAgentService(publicKey, options = {}) {
   assertCanonicalInstalledLauncher(env, options.invocationPath);
   const path = systemdUserUnitPath(env);
   const content = agentServiceUnit();
-  const existing = await readFile2(path, "utf8").catch(() => "");
+  const existing = await readFile7(path, "utf8").catch(() => "");
   if (existing !== content) {
-    await mkdir7(dirname5(path), { recursive: true, mode: 448 });
-    await writeFile4(path, content, { mode: 384 });
+    await mkdir9(dirname7(path), { recursive: true, mode: 448 });
+    await writeFile7(path, content, { mode: 384 });
   }
   const run2 = options.run ?? runSystemctl;
   await run2(["daemon-reload"]);
@@ -16443,7 +17356,7 @@ async function runStartCommand(args, interactiveUi) {
       continue;
     }
     const spinnerHandle = spinner();
-    spinnerHandle.start(`Starting ${dirname6(path)}\u2026`);
+    spinnerHandle.start(`Starting ${dirname8(path)}\u2026`);
     try {
       await startRuntime(path, spinnerHandle);
       spinnerHandle.stop(import_picocolors.default.green("Started."));
@@ -16459,9 +17372,9 @@ async function runStartCommand(args, interactiveUi) {
 
 // apps/body/dist/connect-command.js
 import { spawn as spawn5 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import { chmod as chmod4, mkdir as mkdir10, readFile as readFile5, unlink as unlink2, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname9, resolve as resolve15 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+import { chmod as chmod4, mkdir as mkdir11, readFile as readFile9, unlink as unlink2, writeFile as writeFile9 } from "node:fs/promises";
+import { dirname as dirname10, resolve as resolve19 } from "node:path";
 import { stdin as stdin3, stdout as stdout4 } from "node:process";
 
 // packages/api-contract/dist/agent-pairing-code.js
@@ -16771,63 +17684,6 @@ async function pairDevice(grant, options = {}) {
   return { runtime: activated.runtime, configPath: staged.configPath, pid };
 }
 
-// apps/body/dist/provider-key-store.js
-import { chmod as chmod2, mkdir as mkdir8, readFile as readFile3, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname7, resolve as resolve13 } from "node:path";
-var PROVIDER_KEY_ENV_VARS = {
-  openrouter: "OPENROUTER_API_KEY",
-  openai: "OPENAI_API_KEY",
-  anthropic: "ANTHROPIC_API_KEY",
-  google: "GOOGLE_API_KEY",
-  xai: "XAI_API_KEY"
-};
-var GOOGLE_ENV_ALIAS = "GEMINI_API_KEY";
-function providerKeyStorePath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve13(homedir8(), ".config");
-  return resolve13(configRoot, "beeline", "providers.json");
-}
-async function readProviderKeyStore(env = process.env) {
-  const path = providerKeyStorePath(env);
-  const raw = await readFile3(path, "utf8").catch(() => void 0);
-  if (!raw)
-    return {};
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return {};
-    const entries = Object.entries(parsed).filter((entry) => entry[0] in PROVIDER_KEY_ENV_VARS && typeof entry[1] === "string" && entry[1].length > 0);
-    return Object.fromEntries(entries);
-  } catch {
-    return {};
-  }
-}
-async function readSavedProviderKey(provider, env = process.env) {
-  return (await readProviderKeyStore(env))[provider];
-}
-async function saveProviderKey(provider, key, env = process.env) {
-  const path = providerKeyStorePath(env);
-  const store = { ...await readProviderKeyStore(env), [provider]: key };
-  await mkdir8(dirname7(path), { recursive: true, mode: 448 });
-  await writeFile5(path, `${JSON.stringify(store, null, 2)}
-`, { mode: 384 });
-  await chmod2(path, 384);
-}
-function providerKeyFromEnvironment(provider, env = process.env) {
-  const primary = env[PROVIDER_KEY_ENV_VARS[provider]]?.trim();
-  if (primary)
-    return primary;
-  if (provider === "google")
-    return env[GOOGLE_ENV_ALIAS]?.trim() || void 0;
-  return void 0;
-}
-function maskProviderKey(key) {
-  const trimmed = key.trim();
-  if (trimmed.length <= 9)
-    return "\u2026";
-  return `${trimmed.slice(0, 6)}\u2026${trimmed.slice(-3)}`;
-}
-
 // apps/body/dist/connect-command.js
 init_self_update();
 init_self_update_manifest();
@@ -17044,7 +17900,7 @@ function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl) {
   const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
   if (!normalizedPairingCode)
     throw new Error("invalid pairing code");
-  const avatarSeed = createHash3("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
+  const avatarSeed = createHash4("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
   return jsonRequest(`${baseUrl}/auth/agent/connect`, {
     pairing_code: normalizedPairingCode,
     harness: selection.harness,
@@ -17069,7 +17925,7 @@ async function installCurrentRelease(fetchImpl) {
   });
   await activateRelease(layout, releaseId);
   return {
-    binary: resolve15(layout.binDir, "beeline"),
+    binary: resolve19(layout.binDir, "beeline"),
     version: published.version ?? releaseId
   };
 }
@@ -17092,8 +17948,8 @@ function providerEnvironment(selection) {
   };
 }
 async function writePrivateJson(path, value) {
-  await mkdir10(dirname9(path), { recursive: true, mode: 448 });
-  await writeFile7(path, `${JSON.stringify(value, null, 2)}
+  await mkdir11(dirname10(path), { recursive: true, mode: 448 });
+  await writeFile9(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await chmod4(path, 384);
 }
@@ -17101,10 +17957,10 @@ async function writeProviderEnv(selection, agentPubkey) {
   const values = providerEnvironment(selection);
   if (Object.keys(values).length === 0)
     return void 0;
-  const path = resolve15(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
-  await mkdir10(dirname9(path), { recursive: true, mode: 448 });
+  const path = resolve19(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
+  await mkdir11(dirname10(path), { recursive: true, mode: 448 });
   const contents = Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
-  await writeFile7(path, `${contents}
+  await writeFile9(path, `${contents}
 `, { mode: 384 });
   await chmod4(path, 384);
   return path;
@@ -17158,7 +18014,7 @@ async function runConnectCommand(code, options = {}) {
   const grant = await brassSpinner("Connecting to your Beeline Workspace\u2026", () => requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl), (connectedGrant) => `Connected to ${connectedGrant.workspace_name}`);
   const installedRelease = await brassSpinner("Installing the Beeline daemon\u2026", () => installCurrentRelease(fetchImpl), (release) => `Installed Beeline helper ${release.version}`);
   const llmEnvFile = await writeProviderEnv(selection, grant.agent_pubkey);
-  const grantPath = resolve15(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
+  const grantPath = resolve19(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
   await writePrivateJson(grantPath, {
     agentSecretKey: grant.agent_secret_key,
     bodySecretKey: grant.body_secret_key,
@@ -17209,11 +18065,22 @@ async function runConnectFinishCommand(path) {
     throw new Error("connect-finish may run only from the canonical installed Beeline launcher");
   }
   try {
-    const grant = JSON.parse(await readFile5(resolve15(path), "utf8"));
+    const grant = JSON.parse(await readFile9(resolve19(path), "utf8"));
     if (!isDevicePairingGrant(grant))
       throw new Error("device connection grant is invalid");
-    await completeDevicePairing(grant);
-    await unlink2(resolve15(path));
+    const connected = await completeDevicePairing(grant);
+    await unlink2(resolve19(path));
+    const providerEnv = grant.llmEnvFile ? await readFile9(grant.llmEnvFile, "utf8").catch(() => "") : "";
+    const model = openRouterModelId(grant.model, {
+      OPENROUTER_API_KEY: /^OPENROUTER_API_KEY=\S/m.test(providerEnv) ? "set" : ""
+    });
+    if (model) {
+      const decision2 = await resolveOpenRouterRouting({
+        model,
+        cacheDir: openRouterRoutingCacheDir(dirname10(connected.configPath))
+      });
+      console.log(decision2.line);
+    }
   } catch (error) {
     throw new ConnectFailureError(connectPlainFailure(error));
   }
@@ -17227,20 +18094,20 @@ init_self_update_manifest();
 // apps/body/dist/managed-update.js
 init_self_update();
 import { spawn as spawn6 } from "node:child_process";
-import { mkdir as mkdir12, rm as rm5, stat as stat2, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname11, resolve as resolve17 } from "node:path";
+import { mkdir as mkdir13, rm as rm5, stat as stat2, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname12, resolve as resolve21 } from "node:path";
 
 // apps/body/dist/update-rollback-alert.js
-import { mkdir as mkdir11, readFile as readFile6, rename as rename4, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve16 } from "node:path";
+import { mkdir as mkdir12, readFile as readFile10, rename as rename4, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname11, resolve as resolve20 } from "node:path";
 function updateRollbackAlertPath(runtimeDir) {
-  return resolve16(runtimeDir, "update-rollback-alert.json");
+  return resolve20(runtimeDir, "update-rollback-alert.json");
 }
 async function writeAlert(runtimeDir, alert) {
   const path = updateRollbackAlertPath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir11(dirname10(path), { recursive: true });
-  await writeFile8(staged, `${JSON.stringify(alert, null, 2)}
+  await mkdir12(dirname11(path), { recursive: true });
+  await writeFile10(staged, `${JSON.stringify(alert, null, 2)}
 `, { mode: 384 });
   await rename4(staged, path);
 }
@@ -17252,7 +18119,7 @@ async function queueUpdateRollbackAlert(runtimeDir, releaseId, now2 = Date.now()
 }
 async function readUpdateRollbackAlert(runtimeDir) {
   try {
-    const value = JSON.parse(await readFile6(updateRollbackAlertPath(runtimeDir), "utf8"));
+    const value = JSON.parse(await readFile10(updateRollbackAlertPath(runtimeDir), "utf8"));
     if (value.version !== 1 || typeof value.releaseId !== "string")
       return void 0;
     return value;
@@ -17277,13 +18144,13 @@ var LOCK_STALE_MS = UPDATE_WORKER_DEADLINE_MS + 5 * 6e4;
 var DEFAULT_UPDATE_INITIAL_DELAY_MS = 0;
 async function withInstallLock(layout, work, options = {}) {
   const now2 = options.now ?? Date.now;
-  const lock = resolve17(layout.releasesRoot, ".state", "install.lock");
+  const lock = resolve21(layout.releasesRoot, ".state", "install.lock");
   const deadline = now2() + (options.waitMs ?? 1e4);
-  await mkdir12(dirname11(lock), { recursive: true });
+  await mkdir13(dirname12(lock), { recursive: true });
   for (; ; ) {
     try {
-      await mkdir12(lock);
-      await writeFile9(resolve17(lock, "owner"), `${process.pid}
+      await mkdir13(lock);
+      await writeFile11(resolve21(lock, "owner"), `${process.pid}
 ${now2()}
 `, "utf8");
       break;
@@ -17320,7 +18187,6 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
   #requested = false;
   #restartRequest;
   #stagedReleaseId;
-  #drainDeadlineLogged = false;
   constructor(options) {
     this.#layout = options.layout;
     this.#loadedRelease = options.loadedRelease;
@@ -17407,7 +18273,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       if (!attempt || attempt.releaseId !== desiredRelease || attempt.status !== "pending") {
         const from = await readInstalledBundleIdentity({
           ...this.#layout,
-          libDir: resolve17(this.#layout.releasesRoot, this.#loadedRelease)
+          libDir: resolve21(this.#layout.releasesRoot, this.#loadedRelease)
         }).catch(() => void 0) ?? {};
         const to = await readInstalledBundleIdentity(this.#layout).catch(() => void 0) ?? {};
         const record2 = {
@@ -17444,11 +18310,13 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
   }
   /**
    * Resolve one handoff tick against the daemon's authoritative turn registry.
-   * A staged release stays inert while accepted work is running.
-   * `quiesceIfIdle` closes intake in the same synchronous transition that
-   * proves idle, so a new turn cannot race activation. Expiring the bounded
-   * drain window records delayed convergence; it never turns a routine update
-   * into an ACP cancellation or a failed Room receipt.
+   * Busy means a turn is executing right now; serving Rooms and corners with
+   * no turn in flight is idle. `quiesceIfIdle` closes intake in the same
+   * synchronous transition that proves idle, so a new turn cannot race
+   * activation. A staged release stays inert while a turn runs — until the
+   * absolute drain deadline, when the restart is forced (`forced: true`) and
+   * the caller cancels the running turn; the convergence contract outranks a
+   * stuck turn. `ManagedUpdateDrain` enforces that deadline with a timer.
    */
   async restartRequest(quiesceIfIdle) {
     const activeDrift = await this.check();
@@ -17457,12 +18325,11 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
     const request = this.#restartRequest;
     if (!request)
       throw new Error("update drift was detected without an in-memory restart request");
+    let forced = false;
     if (!quiesceIfIdle()) {
-      if (this.#now() >= request.drainDeadlineAt && !this.#drainDeadlineLogged) {
-        console.log(`[thin-core] update drain window elapsed with active work; keeping the staged release ${request.desiredRelease} inert instead of interrupting the Room turn`);
-        this.#drainDeadlineLogged = true;
-      }
-      return { kind: "waiting", request };
+      if (this.#now() < request.drainDeadlineAt)
+        return { kind: "waiting", request };
+      forced = true;
     }
     if (this.#stagedReleaseId) {
       const stagedReleaseId = this.#stagedReleaseId;
@@ -17482,7 +18349,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       this.#restartRequest = void 0;
       await this.#journalDrift(stagedReleaseId);
     }
-    return { kind: "restart", request: this.#restartRequest ?? request };
+    return { kind: "restart", request: this.#restartRequest ?? request, forced };
   }
 };
 async function coordinateManagedUpdateHandoff(update, quiesceIfIdle, restart, waiting = async () => void 0) {
@@ -17493,9 +18360,88 @@ async function coordinateManagedUpdateHandoff(update, quiesceIfIdle, restart, wa
     await waiting(next.request);
     return "waiting-for-idle";
   }
-  await restart(next.request);
+  await restart(next.request, next.forced ? "forced" : "drained");
   return "restarting";
 }
+var UPDATE_DRAIN_WAIT_LOG_INTERVAL_MS = 6e4;
+var ManagedUpdateDrain = class {
+  #options;
+  #now;
+  #log;
+  #setTimer;
+  #clearTimer;
+  #deadlineTimer;
+  #waitLogTimer;
+  #resolving;
+  #restarting = false;
+  constructor(options) {
+    this.#options = options;
+    this.#now = options.now ?? Date.now;
+    this.#log = options.log ?? ((line) => console.log(line));
+    this.#setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+    this.#clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  }
+  /** Called from every completed core progress tick. */
+  tick() {
+    return this.#resolve();
+  }
+  #resolve() {
+    if (this.#restarting)
+      return Promise.resolve("restarting");
+    if (this.#resolving)
+      return this.#resolving;
+    this.#resolving = this.#step().finally(() => {
+      this.#resolving = void 0;
+    });
+    return this.#resolving;
+  }
+  async #step() {
+    const { update, quiesceIfIdle, activeTurnCount } = this.#options;
+    let armed;
+    const progress = await coordinateManagedUpdateHandoff(update, quiesceIfIdle, async (request, mode) => {
+      this.#disarm();
+      if (mode === "forced") {
+        this.#log(`[thin-core] update restart forced: drain deadline reached with ${activeTurnCount()} active turn(s); cancelling them and restarting onto ${request.desiredRelease}`);
+      }
+      await this.#options.restart(request, mode);
+      this.#restarting = true;
+    }, async (request) => {
+      armed = request;
+      await this.#options.waiting?.(request);
+    });
+    if (armed && !this.#deadlineTimer)
+      this.#arm(armed);
+    return progress;
+  }
+  #arm(request) {
+    this.#logWaiting(request);
+    this.#scheduleWaitLog(request);
+    this.#deadlineTimer = this.#setTimer(() => void this.#resolve().catch((error) => {
+      this.#log(`[thin-core] update restart at the drain deadline failed; retrying on the next tick: ${error instanceof Error ? error.message : String(error)}`);
+    }), Math.max(0, request.drainDeadlineAt - this.#now()));
+  }
+  #scheduleWaitLog(request) {
+    this.#waitLogTimer = this.#setTimer(() => {
+      this.#waitLogTimer = void 0;
+      if (this.#restarting)
+        return;
+      this.#logWaiting(request);
+      this.#scheduleWaitLog(request);
+    }, UPDATE_DRAIN_WAIT_LOG_INTERVAL_MS);
+  }
+  #logWaiting(request) {
+    const minutesLeft = Math.max(0, Math.ceil((request.drainDeadlineAt - this.#now()) / 6e4));
+    this.#log(`[thin-core] update restart waiting: ${this.#options.activeTurnCount()} active turn(s); deadline in ${minutesLeft}m`);
+  }
+  #disarm() {
+    if (this.#deadlineTimer !== void 0)
+      this.#clearTimer(this.#deadlineTimer);
+    if (this.#waitLogTimer !== void 0)
+      this.#clearTimer(this.#waitLogTimer);
+    this.#deadlineTimer = void 0;
+    this.#waitLogTimer = void 0;
+  }
+};
 function numberEnv(env, name, fallback) {
   const value = Number(env[name]);
   return Number.isFinite(value) && value >= 0 ? value : fallback;
@@ -17614,7 +18560,7 @@ async function proveLoadedReleaseReady(layout, runtimeDir, loadedRelease, option
   });
   if (!accepted)
     return false;
-  await writeFile9(resolve17(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
+  await writeFile11(resolve21(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
     readyAt: (options.now ?? Date.now)(),
     loadedRelease,
     functionalProof: options.functionalProof
@@ -17819,16 +18765,16 @@ async function runUpdateCommand(args) {
 init_self_update();
 
 // apps/body/dist/daemon-failure.js
-import { mkdir as mkdir13, readFile as readFile7, rename as rename5, rm as rm6, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname12, resolve as resolve18 } from "node:path";
+import { mkdir as mkdir14, readFile as readFile11, rename as rename5, rm as rm6, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname13, resolve as resolve22 } from "node:path";
 var DAEMON_FAILURE_LIMIT = 3;
 var DAEMON_FAILURE_WINDOW_MS = 5 * 6e4;
 function daemonFailurePath(runtimeDir) {
-  return resolve18(runtimeDir, "daemon-distress.json");
+  return resolve22(runtimeDir, "daemon-distress.json");
 }
 async function readFailureRecord(runtimeDir) {
   try {
-    const value = JSON.parse(await readFile7(daemonFailurePath(runtimeDir), "utf8"));
+    const value = JSON.parse(await readFile11(daemonFailurePath(runtimeDir), "utf8"));
     if (value.version !== 1 || !Array.isArray(value.failures) || value.failures.some((failure) => typeof failure !== "number") || typeof value.lastError !== "string") {
       return void 0;
     }
@@ -17840,8 +18786,8 @@ async function readFailureRecord(runtimeDir) {
 async function writeFailureRecord(runtimeDir, record2) {
   const path = daemonFailurePath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir13(dirname12(path), { recursive: true, mode: 448 });
-  await writeFile10(staged, `${JSON.stringify(record2, null, 2)}
+  await mkdir14(dirname13(path), { recursive: true, mode: 448 });
+  await writeFile12(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename5(staged, path);
 }
@@ -17863,9 +18809,9 @@ async function clearDaemonStartFailures(runtimeDir) {
 }
 
 // apps/body/dist/update-functional-probe.js
-import { mkdir as mkdir14, rm as rm7 } from "node:fs/promises";
+import { mkdir as mkdir15, rm as rm7 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { resolve as resolve19 } from "node:path";
+import { resolve as resolve23 } from "node:path";
 var UPDATE_PROBE_SESSION_TIMEOUT_MS = 1e4;
 var UPDATE_PROBE_SESSION_OPEN_TIMEOUT_MS = 2e4;
 var UPDATE_PROBE_TURN_TIMEOUT_MS = 45e3;
@@ -17887,11 +18833,11 @@ async function runUpdateFunctionalProbe(input) {
   if (input.sandboxRequired && !input.config.bwrapPath) {
     throw new UpdateFunctionalProbeError("sandbox-unavailable", "the configured bubblewrap boundary did not pass its startup self-test");
   }
-  const root = resolve19(input.runtimeDir, "update-functional-probe");
-  const cwd = resolve19(root, "checkout");
-  const homeRoot = resolve19(root, "agent-home");
+  const root = resolve23(input.runtimeDir, "update-functional-probe");
+  const cwd = resolve23(root, "checkout");
+  const homeRoot = resolve23(root, "agent-home");
   await rm7(root, { recursive: true, force: true });
-  await mkdir14(cwd, { recursive: true, mode: 448 });
+  await mkdir15(cwd, { recursive: true, mode: 448 });
   let client;
   try {
     const agentEnv = {
@@ -17901,7 +18847,8 @@ async function runUpdateFunctionalProbe(input) {
         operatorHome: input.config.operatorHome ?? homedir10(),
         sharedSkills: input.config.sharedSkills ?? [],
         skillReleaseId: input.releaseId,
-        failClosed: true
+        failClosed: true,
+        ...openRouterRoutingInput({ ...input.config, openRouterRoutingCacheDir: openRouterRoutingCacheDir(input.runtimeDir) }, input.config.modelSelection)
       })
     };
     const selectedAgent = {
@@ -17913,11 +18860,12 @@ async function runUpdateFunctionalProbe(input) {
       command,
       args: agentArgsWithModelSelection(selectedAgent, input.config.modelSelection)
     };
+    let modelAnswer = {};
     if (input.config.bwrapPath) {
       const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
       const operatorHome = input.config.operatorHome ?? homedir10();
       const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-      await Promise.all(homeStateDirs.map((dir) => mkdir14(dir, { recursive: true })));
+      await Promise.all(homeStateDirs.map((dir) => mkdir15(dir, { recursive: true })));
       spawnCommand = wrapAgentCommand({
         bwrapPath: input.config.bwrapPath,
         spec: {
@@ -17956,8 +18904,21 @@ async function runUpdateFunctionalProbe(input) {
       }
       try {
         const served = await client.sessionPrompt(opened.sessionId, "Reply READY.", input.turnTimeoutMs ?? UPDATE_PROBE_TURN_TIMEOUT_MS);
-        if (!served.agentText.trim()) {
-          throw new UpdateFunctionalProbeError("turn-failed", "the harness completed a session/prompt without an agent answer");
+        if (served.agentText.trim()) {
+          modelAnswer = { modelAnswer: "served" };
+        } else {
+          const explained = await explainEmptyAgentTurn({
+            agentLabel: command,
+            agentEnv,
+            sessionId: opened.sessionId,
+            result: served
+          });
+          const modelSide = isAccountOrProviderRefusal(explained.record) || explained.record?.kind === "empty";
+          if (!modelSide) {
+            throw new UpdateFunctionalProbeError("turn-failed", `the harness completed a session/prompt without an agent answer: ${explained.reason}`);
+          }
+          console.warn(`[body] update probe: the bundle reached the model boundary but the model answered nothing (${explained.reason}); that is the model's own answer on any release, so the probe passes without one`);
+          modelAnswer = { modelAnswer: "unavailable", modelAnswerReason: explained.reason };
         }
       } catch (error) {
         throw new UpdateFunctionalProbeError("turn-failed", error instanceof Error ? error.message : String(error), { cause: error });
@@ -17972,7 +18933,8 @@ async function runUpdateFunctionalProbe(input) {
       sandboxed: Boolean(input.config.bwrapPath),
       sessionStarted: true,
       turnCompleted: true,
-      nativeTools: []
+      nativeTools: [],
+      ...modelAnswer
     };
   } finally {
     await client?.stop().catch(() => void 0);
@@ -17981,8 +18943,8 @@ async function runUpdateFunctionalProbe(input) {
 }
 
 // apps/body/dist/release-status.js
-import { readFile as readFile8, readdir as readdir3, rename as rename6, writeFile as writeFile11 } from "node:fs/promises";
-import { resolve as resolve20 } from "node:path";
+import { readFile as readFile12, readdir as readdir4, rename as rename6, writeFile as writeFile13 } from "node:fs/promises";
+import { resolve as resolve24 } from "node:path";
 var DAEMON_RELEASE_STATUS_FILE = "release-status.json";
 var RELEASE_VERSION = /^v\d+\.\d+\.\d+$/;
 var SOURCE_SHA = /^[0-9a-f]{7,64}$/;
@@ -17999,9 +18961,9 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
     pid: options.pid ?? process.pid,
     readyAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
-  const target = resolve20(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
+  const target = resolve24(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
   const temporary = `${target}.${status.pid}.tmp`;
-  await writeFile11(temporary, `${JSON.stringify(status, null, 2)}
+  await writeFile13(temporary, `${JSON.stringify(status, null, 2)}
 `, { mode: 384 });
   await rename6(temporary, target);
   return status;
@@ -18042,7 +19004,7 @@ var DaemonExitError = class extends Error {
 };
 async function runStoredDaemon(pathOrPointer) {
   const configPath = await resolveRuntimeConfigPath(pathOrPointer);
-  daemonFailureRuntimeDir = dirname13(configPath);
+  daemonFailureRuntimeDir = dirname14(configPath);
   const accessMigration = await migrateRuntimeRecordAccessPolicy(configPath);
   let runtime = accessMigration.runtime;
   if (!runtime.transport) {
@@ -18054,7 +19016,7 @@ async function runStoredDaemon(pathOrPointer) {
   runtime = activated.runtime;
   const daemonApi = activated.client;
   const agent = runtimeAgentCommand(runtime);
-  await writeFile12(resolve21(dirname13(configPath), "daemon.pid"), `${process.pid}
+  await writeFile14(resolve25(dirname14(configPath), "daemon.pid"), `${process.pid}
 `, { mode: 384 });
   const env = {
     ...process.env,
@@ -18062,7 +19024,7 @@ async function runStoredDaemon(pathOrPointer) {
     BUZZ_DEV_MCP_BIN: runtime.mcpBinary
   };
   const config = loadBodyConfig({
-    workspaceRoot: resolve21(dirname13(configPath), "workspace"),
+    workspaceRoot: resolve25(dirname14(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env,
     agent
@@ -18097,7 +19059,7 @@ async function runStoredDaemon(pathOrPointer) {
   const stop = () => controller.abort();
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
-  const runtimeDir = dirname13(configPath);
+  const runtimeDir = dirname14(configPath);
   const layout = beelineInstallLayout(process.env);
   const notifier = new SystemdNotifier();
   let rollbackAlertDrain;
@@ -18143,6 +19105,22 @@ async function runStoredDaemon(pathOrPointer) {
   let stoppingStatus = "daemon stopped";
   try {
     const core = new ThinDaemonCore(runtime, configPath, config, { daemonApi });
+    const updateDrain = update ? new ManagedUpdateDrain({
+      update,
+      quiesceIfIdle: () => core.quiesceForUpdateIfIdle(),
+      activeTurnCount: () => core.activeTurnCount(),
+      restart: async ({ desiredRelease, drainDeadlineAt }, mode) => {
+        if (mode === "forced")
+          await core.prepareForForcedUpdateRestart();
+        core.setDrainDeadlineAt(drainDeadlineAt);
+        stoppingStatus = `update pending, converging; loaded_release=${loadedRelease ?? "unknown"}; desired_release=${desiredRelease}; ${mode === "forced" ? "active work cancelled at the drain deadline" : "active work drained"}; intake quiesced; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`;
+        await notifier.stopping(stoppingStatus);
+        controller.abort();
+      },
+      waiting: async ({ desiredRelease, drainDeadlineAt }) => {
+        await notifier.progress(`loaded_release=${loadedRelease ?? "unknown"}; update ready; active agent work is still running; handoff deferred; desired_release=${desiredRelease}; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`);
+      }
+    }) : void 0;
     const result = await core.run({
       signal: controller.signal,
       onEstablished: async () => {
@@ -18166,28 +19144,26 @@ async function runStoredDaemon(pathOrPointer) {
           }
           functionalProof = gate.proof;
           pendingSuccessor = false;
-          console.log(`[thin-core] successor functional probe passed on exact release ${loadedRelease}: ${functionalProof?.harness ?? "unknown"} session/new + turn`);
+          console.log(`[thin-core] successor functional probe passed on exact release ${loadedRelease}: ${functionalProof?.harness ?? "unknown"} session/new + turn` + (functionalProof?.modelAnswer === "unavailable" ? ` (model answer unavailable: ${functionalProof.modelAnswerReason})` : ""));
         }
         await clearDaemonStartFailures(runtimeDir);
         await writeDaemonReleaseStatus(runtimeDir, runtime.agent.publicKey, loadedReleaseIdentity);
         await notifier.ready(`ready; loaded_release=${loadedRelease ?? "development"}`);
         ready = true;
+        void syncAgentModelCatalog({
+          api: daemonApi,
+          agent,
+          agentEnv: config.agentEnv,
+          agentId: runtime.agent.publicKey,
+          workspaceId: runtime.communityId,
+          runtimeDir,
+          ...runtime.modelSelection ? { runtimeSelection: runtime.modelSelection } : {}
+        });
       },
       onProgress: async (status) => {
         void drainRollbackAlert(core.activeRoomIds()[0] ?? runtime.rooms[0]?.channelId);
         await notifier.progress(`loaded_release=${loadedRelease ?? "development"}; ${status}`);
-        if (!update)
-          return;
-        await coordinateManagedUpdateHandoff(update, () => core.quiesceForUpdateIfIdle(), async ({ desiredRelease, drainDeadlineAt }) => {
-          if (Date.now() >= drainDeadlineAt)
-            await core.prepareForForcedUpdateRestart();
-          core.setDrainDeadlineAt(drainDeadlineAt);
-          stoppingStatus = `update pending, converging; loaded_release=${loadedRelease ?? "unknown"}; desired_release=${desiredRelease}; active work drained; intake quiesced; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`;
-          await notifier.stopping(stoppingStatus);
-          controller.abort();
-        }, async ({ desiredRelease, drainDeadlineAt }) => {
-          await notifier.progress(`loaded_release=${loadedRelease ?? "unknown"}; update ready; active agent work is still running; handoff deferred; desired_release=${desiredRelease}; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`);
-        });
+        await updateDrain?.tick();
       }
     });
     if (result === "agent-removed") {
@@ -18209,8 +19185,8 @@ async function runStoredDaemon(pathOrPointer) {
     throw error;
   } finally {
     await notifier.stopping(stoppingStatus).catch(() => void 0);
-    const pidPath = resolve21(dirname13(configPath), "daemon.pid");
-    const recorded = Number((await readFile9(pidPath, "utf8").catch(() => "")).trim());
+    const pidPath = resolve25(dirname14(configPath), "daemon.pid");
+    const recorded = Number((await readFile13(pidPath, "utf8").catch(() => "")).trim());
     if (recorded === process.pid) {
       await unlink3(pidPath).catch(() => void 0);
     }
@@ -18266,14 +19242,14 @@ async function main() {
     const agentPubkey = agentFlag >= 0 ? args[agentFlag + 1] : void 0;
     if (!configPath && agentPubkey) {
       const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-      configPath = configs.find((candidate) => dirname13(candidate).endsWith(agentPubkey));
+      configPath = configs.find((candidate) => dirname14(candidate).endsWith(agentPubkey));
     }
     if (!configPath && agentPubkey) {
       throw new DaemonExitError(`unknown agent ${agentPubkey}: no durable runtime exists; refusing systemd restart loop`, UNKNOWN_AGENT_EXIT_STATUS);
     }
     if (!configPath)
       throw new Error("daemon requires --config <runtime.json> or --agent <pubkey>");
-    await runStoredDaemon(resolve21(configPath));
+    await runStoredDaemon(resolve25(configPath));
     return;
   }
   if (command === "update") {
@@ -18290,7 +19266,7 @@ async function main() {
     if (!agentPubkey)
       throw new Error("stop requires --agent <pubkey>");
     const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-    const configPath = configs.find((candidate) => dirname13(candidate).endsWith(agentPubkey));
+    const configPath = configs.find((candidate) => dirname14(candidate).endsWith(agentPubkey));
     if (!configPath)
       throw new Error(`no stored runtime found for agent ${agentPubkey}`);
     const runtime = await readRuntimeRecord(configPath);